Fix Docker permissions

docker-compose.yml

@@ -158,6 +158,10 @@ services:
             - /var/run/docker.sock:/var/run/docker.sock
             - ${REPO_CURATED}:${REPO_CURATED}:ro
             - ${REPO_CONFIG}:${REPO_CONFIG}:ro
+            # docker plugin requires a shared workspace
+            # docker-in-docker can't share an internal workspace so we need
+            # an external volume
+            - ./docker-workspace:/home/omero/workspace
         environment:
             - SLAVE_NAME=docker
             - SLAVE_PARAMS=-labels docker -disableClientsUniqueId -executors ${DOCKER_EXECUTORS}

docker-workspace/.gitignore

@@ -0,0 +1 @@
+*/

docker/Dockerfile

@@ -14,9 +14,10 @@ RUN yum -y install docker-ce
 
 # Change user id to fix permissions issues
 ARG USER_ID=1000
-RUN usermod -u $USER_ID omero
+RUN usermod -u $USER_ID -aG docker omero
 
 COPY run.sh /tmp/run.sh
 RUN chmod a+x /tmp/run.sh
-USER omero
+# Start as root so docker permissions can be fixed
+# Drop to omero in startup script
 CMD ["/tmp/run.sh"]

docker/run.sh

@@ -1,3 +1,14 @@
 #!/bin/bash
 
-/tmp/jenkins-slave.sh
+set -eu
+set -x
+
+# Adjust docker permissions
+# https://github.com/jenkinsci/docker/issues/263#issuecomment-217955379
+sudo groupmod -g $(stat -c %g /var/run/docker.sock) docker
+sudo usermod -aG docker omero
+# This is mounted from outside, so you may need to fix permissions
+# https://support.cloudbees.com/hc/en-us/articles/360000304932-Pipeline-jobs-fail-to-run-in-a-Docker-in-Docker-step
+#sudo chown omero /home/omero/workspace
+
+exec sudo -iu omero env SLAVE_PARAMS="$SLAVE_PARAMS" SLAVE_EXECUTORS="$SLAVE_EXECUTORS" SLAVE_NAME="$SLAVE_NAME" JENKINS_MASTER="$JENKINS_MASTER" /tmp/jenkins-slave.sh