Fix docker installation for CI

.travis.yml

@@ -1,6 +1,6 @@
 language: go
 sudo: required
-dist: trusty
+dist: xenial
 
 go:
   - 1.11.x

hack/install-docker.sh

@@ -18,19 +18,27 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+# Workarounds for error "Failed to fetch https://packagecloud.io/github/git-lfs/ubuntu/dists/trusty/InRelease"
+# TODO: remove it after the issue fixed in git-lfs.
+sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6B05F25D762E3157
 
 # Install docker.
-sudo sh -c 'echo "deb https://apt.dockerproject.org/repo ubuntu-$(lsb_release -cs) main" > /etc/apt/sources.list.d/docker.list'
-curl -fsSL https://apt.dockerproject.org/gpg | sudo apt-key add -
-sudo apt-key fingerprint 58118E89F3A912897C070ADBF76221572C52609D
 sudo apt-get update
-sudo apt-get -y install "docker-engine=17.03.1~ce-0~ubuntu-$(lsb_release -cs)"
-
-# docker debs don't support seccomp, so we install a static version instead.
-curl -sSL -o docker.tgz https://download.docker.com/linux/static/stable/x86_64/docker-17.03.1-ce.tgz
-tar xzvf docker.tgz
-sudo cp -f docker/* /usr/bin
-rm -f docker.tgz
+sudo apt-get install -y\
+    apt-transport-https \
+    ca-certificates \
+    curl socat \
+    gnupg-agent \
+    software-properties-common
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
+sudo add-apt-repository \
+   "deb [arch=amd64] https://download.docker.com/linux/ubuntu \
+   $(lsb_release -cs) \
+   stable"
+sudo apt-get update
+# Docker is downgraded because exec process in 18.x doesn't inherit additional group id from the init process.
+# See more details at https://github.com/moby/moby/issues/38865.
+sudo apt-get -y --allow-downgrades install docker-ce=17.03.3~ce-0~ubuntu-xenial
 
 # Restart docker daemon.
 sudo service docker restart

hack/run-critest.sh

@@ -36,4 +36,6 @@ sleep 10
 critest -ginkgo.skip="runtime should support reopening container log|runtime should support execSync with timeout" -parallel 8
 
 # Run benchmark test cases
-critest -benchmark
+# Skip image operations benchmark because dockershim would panic on such cases.
+# TODO: enable it again after https://github.com/kubernetes/kubernetes/pull/75367 get fixed.
+critest -benchmark -ginkgo.skip="Image"