apiVersion: tekton.dev/v1alpha1
kind: TaskRun
metadata:
  generateName: dind-sidecar-
spec:
  taskSpec:
    steps:
    - image: docker
      name: client
      env:
      # Connect to the sidecar over TCP without TLS.
      - name: DOCKER_HOST
        value: tcp://localhost:2375
      script: |
          #!/usr/bin/env sh
          # Run a Docker container.
          docker run busybox echo hello

          # Write a Dockerfile and `docker build` it.
          cat > Dockerfile << EOF
          FROM ubuntu
          RUN apt-get update
          ENTRYPOINT ["echo", "hello"]
          EOF
          docker build -t hello . && docker run hello
          docker images

          # ...then run it!
          docker run hello
      volumeMounts:
      - mountPath: /var/run/
        name: dind-socket

    sidecars:
    - image: docker:dind
      name: server
      securityContext:
        privileged: true
      env:
      # This disables TLS for TCP connections between the sidecar and client step.
      - name: DOCKER_TLS_CERTDIR
        value: ''
      volumeMounts:
      - mountPath: /var/run/
        name: dind-socket

    volumes:
    - name: dind-socket
      emptyDir: {}

apiVersion: tekton.dev/v1alpha1
kind: TaskRun
metadata:
  generateName: dind-sidecar-
spec:
  taskSpec:
    steps:
    - image: docker
      name: client
      env:
      # Connect to the sidecar over TCP, with TLS.
      - name: DOCKER_HOST
        value: tcp://localhost:2376
      # Verify TLS.
      - name: DOCKER_TLS_VERIFY
        value: '1'
      # Use the certs generated by the sidecar daemon.
      - name: DOCKER_CERT_PATH
        value: /certs/client
      script: |
          #!/usr/bin/env sh
          # Run a Docker container.
          docker run busybox echo hello

          # Write a Dockerfile and `docker build` it.
          cat > Dockerfile << EOF
          FROM ubuntu
          RUN apt-get update
          ENTRYPOINT ["echo", "hello"]
          EOF
          docker build -t hello . && docker run hello
          docker images

          # ...then run it!
          docker run hello
      volumeMounts:
      - mountPath: /certs/client
        name: dind-certs

    sidecars:
    - image: docker:dind
      name: server
      securityContext:
        privileged: true
      env:
      # Write generated certs to the path shared with the client.
      - name: DOCKER_TLS_CERTDIR
        value: /certs
      volumeMounts:
      - mountPath: /certs/client
        name: dind-certs
      # Wait for the dind daemon to generate the certs it will share with the
      # client.
      readinessProbe:
        periodSeconds: 1
        exec:
          command: ['ls', '/certs/client/ca.pem']

    volumes:
    - name: dind-certs
      emptyDir: {}

Connect to dind sidecar daemon using TLS
Connect to dind sidecar daemon using TLS

- share the path the daemon generates certs into with the client
- instruct the client to look for certs there, and to use them
- add a readinessProbe to wait for the certs to be generated
