feat: Add privileged_mode variable to CodeBuild project configuration

.github/copilot-instructions.md

@@ -64,6 +64,7 @@ The module creates an AWS CodeBuild Project and a webhook in a specific GitHub r
 - `environment_type`: Build environment type (default: LINUX_CONTAINER)
 - `environment_compute_type`: Compute resources (default: BUILD_GENERAL1_SMALL)
 - `environment_image`: Docker image (defaults to aws/codebuild/amazonlinux2-x86_64-standard:5.0)
+- `privileged_mode`: Enable Docker daemon inside the build container (default: false)
 - `create_ecr_repository`: Whether to create an ECR repository
 - `build_timeout`: Build timeout in minutes (default: 5)
 

README.md

@@ -326,6 +326,7 @@ module "github_runner_with_packer" {
 | <a name="input_ingress_with_source_security_group_id"></a> [ingress\_with\_source\_security\_group\_id](#input\_ingress\_with\_source\_security\_group\_id) | List of ingress rules to add to the default security group with source security group IDs | <pre>list(object({<br/>    from_port                = number<br/>    to_port                  = number<br/>    protocol                 = string<br/>    description              = string<br/>    source_security_group_id = string<br/>  }))</pre> | `[]` | no |
 | <a name="input_kms_key_id"></a> [kms\_key\_id](#input\_kms\_key\_id) | The AWS KMS key to be used | `string` | `null` | no |
 | <a name="input_name"></a> [name](#input\_name) | Created resources will be named with this. | `string` | n/a | yes |
+| <a name="input_privileged_mode"></a> [privileged\_mode](#input\_privileged\_mode) | Whether to enable running the Docker daemon inside a Docker container. Set to true if the build project needs to build Docker images or run Docker containers (e.g., via docker-compose, Testcontainers, or LocalStack). | `bool` | `false` | no |
 | <a name="input_s3_logs_bucket_name"></a> [s3\_logs\_bucket\_name](#input\_s3\_logs\_bucket\_name) | Name of the S3 bucket to store logs in. If not specified then logging to S3 will be disabled. | `string` | `null` | no |
 | <a name="input_s3_logs_bucket_prefix"></a> [s3\_logs\_bucket\_prefix](#input\_s3\_logs\_bucket\_prefix) | Prefix to use for the logs in the S3 bucket | `string` | `""` | no |
 | <a name="input_security_group_ids"></a> [security\_group\_ids](#input\_security\_group\_ids) | The list of Security Group IDs for AWS CodeBuild to launch ephemeral EC2 instances in. | `list(string)` | `[]` | no |

main.tf

@@ -44,7 +44,7 @@ resource "aws_codebuild_project" "this" {
       ? "CODEBUILD"
       : "SERVICE_ROLE"
     )
-    # privileged_mode             = true
+    privileged_mode = var.privileged_mode
   }
 
   logs_config {

variables.tf

@@ -59,6 +59,12 @@ variable "environment_compute_type" {
   description = " Information about the compute resources the build project will use. Valid values: `BUILD_GENERAL1_SMALL`, `BUILD_GENERAL1_MEDIUM`, `BUILD_GENERAL1_LARGE`, `BUILD_GENERAL1_2XLARGE`, `BUILD_LAMBDA_1GB`, `BUILD_LAMBDA_2GB`, `BUILD_LAMBDA_4GB`, `BUILD_LAMBDA_8GB`, `BUILD_LAMBDA_10GB`. `BUILD_GENERAL1_SMALL` is only valid if type is set to `LINUX_CONTAINER`. When type is set to `LINUX_GPU_CONTAINER`, compute_type must be `BUILD_GENERAL1_LARGE`. When type is set to `LINUX_LAMBDA_CONTAINER` or `ARM_LAMBDA_CONTAINER`, compute_type must be `BUILD_LAMBDA_XGB`"
 }
 
+variable "privileged_mode" {
+  type        = bool
+  default     = false
+  description = "Whether to enable running the Docker daemon inside a Docker container. Set to true if the build project needs to build Docker images or run Docker containers (e.g., via docker-compose, Testcontainers, or LocalStack)."
+}
+
 variable "environment_image" {
   type        = string
   default     = null