Skip to content

Permission problem with docker-windows isolation process

I am running CI\CD on my own instance. My pipeline is using windows docker with windows images. I am trying to switch from hyperv containers to process isolation.

I set isolation mode in toml file for runner.

[runners.docker]
    tls_verify = false
    image = "mcr.microsoft.com/powershell"
    isolation = "process"

But now I am getting error when gitlab tries to checkout repository.

Fetching changes with git depth set to 1...
error: could not lock config file C:\builds\mat\mat.tmp\git-template\config: Permission denied

When I was doing migration initially i got this error. So I though maybe problem is with docker. I did clean install of docker desktop and for some time isolation process was working. But now this error has appeared again.

I did some investigation, and it seems that gitlab runner is mounting wrong (non empty) directory.

I added sleep to my toml config so that I could check what's happening.

pre_clone_script = "Start-Sleep -Seconds 300"

So when pipeline runs without error's mounted directory for c:\builds is empty. As can be seen below: img_ok

But when I get error about config permission denied, then C:\builds is not empty. It seems that this folder is left from previous pipeline. And it has some weird permissions. No access rights for anybody.

img_bad

I switched to Ispect tab in docker desktop and found that C:\builds is mounted from docker volume. img_mount

I still have some pipelines running in HyperV mode. I think that problem is when volume that was used in HyperV mode is mounted in container that is running process isolation mode.

I think quick solution would be to clean build directory when pipeline finishes, is there such option in gitlab ? or should I do that manually ? Does anybody have any other thoughts why this is happening ?