Amazon-eks-ami: Upgrade docker runtime from 18.6 to 18.9 at least for build toolkit support

[abdennour]

What would you like to be added:
I would like from this software to bake an AMI with the following "recipe":

• eks 1.13
• docker 18.9 or later (Instead of 18.6.1)

Why is this needed:

This is needed by CI/CD system that runs on the EKS cluster (worker nodes) and it leverages docker build-toolkit to build docker images during CI stage.

I am using Build Toolkit to build docker image for each microservice.

export DOCKER_BUILDKIT=1
# ....
docker build -t ....
# ... 

This works on my machine with docker (18.09.2).
However, it does not work with Jenkins which is running on EKS worker nodes , throwing out this message :

buildkit not supported by daemon

I upgraded today to the latest AMI (amazon-eks-node-1.13-v20190906), and I upgraded the EKS from 1.12.10 to 1.13.10.

I ran kubectl get nodes -o wide. Unfortunately, I still see : docker://18.6.1 still there.

More details

https://stackoverflow.com/questions/57847429/docker-buildkit-not-supported-by-daemon-in-aws-eks-kubernetes-cluster

[jrkarnes]

Adding on to this as a request related to running large containers in EKS:

https://github.com/moby/moby/issues/37581

I have had to downgrade to docker 18.03.1 to enable deploying some of our containers because they simply can't be pulled in 18.06

[morganchristiansson]

The RUN --mount=type=ssh feature in docker 18.09 buildkit is also very appealing. It allows cloning of private repos in Dockerfile with ssh agent forwarding from outside docker build container in a very elegant way.

The hacks you have to do to get a private key for cloning private github repos without adding the private key to the final image or in any layers is a bit ugly

http://blog.oddbit.com/post/2019-02-24-docker-build-learns-about-secr/

[mogren]

The latest release (v20191119) includes #373 bumping docker to 18.09.9ce-2.amzn2

[morganchristiansson]

Fantastic! Thank you @mogren I can finally remove my hacks to get pip/yarn install to clone private repos while not adding the private key file into any image layers and use new syntax