How can I run an isolated Docker instance inside a Docker container?

Question

Hey everyone! I'm looking for some guidance on how to run a completely isolated Docker environment, including its own daemon, within another Docker container. I'm building a service that occasionally checks out a Git repository and needs to build a Docker container from it, as well as run a few instances of that container. While everything runs smoothly on my local machine, I'm having issues when I package this service as a Docker image. I want to ensure that the Docker instance inside the container doesn't interfere with the host machine's Docker environment. Here's the Dockerfile I'm currently using:

FROM node:18-alpine AS build
    WORKDIR /app
    COPY . .
    # Some build steps here...
    FROM docker:24-dind AS runtime
    WORKDIR /app
    RUN apk add --no-cache nodejs npm git
    COPY --from=build /app/build ./
    ENTRYPOINT ["dockerd-entrypoint.sh"]
    CMD sleep 5 && npm start

And this is how I'm launching it with Docker Compose:

my-service:
      build:
        context: .
        dockerfile: ./packages/my-service/Dockerfile
      container_name: my-service
      privileged: true

However, when I try to run it, I encounter this error:

ERROR: error during connect: Head "http://docker:2375/_ping": dial tcp: lookup docker on 127.0.0.11:53: no such host

Any help to resolve this would be greatly appreciated!

Yo Motherboard · Answer

There's a workaround if you need that level of isolation using Sysbox. This approach involves running two daemons (`sysbox-fs` and `sysbox-mgr`) on the host. It’s useful especially for interactive courses or setups where isolation is key. Check out the Sysbox documentation [here](https://github.com/nestybox/sysbox) for how to set it up. It allows you to run Docker containers inside Docker containers safely!

Yo Motherboard · Answer

Running Docker in Docker (DIND) can be tricky, but it is definitely possible. Instead of creating an entirely isolated Docker environment, consider mounting the Docker socket from the host into your container. This way, your container can communicate with the Docker daemon on the host without needing a separate daemon inside the container. Here's an example command that shows how to do this:

```bash
docker run -v /var/run/docker.sock:/var/run/docker.sock 
           -v /usr/bin/docker:/usr/bin/docker 
           --name my-docker-client 
           my-image
```

This method does sacrifice some isolation, though, since it will affect the host’s Docker.

Yo Motherboard · Answer

I've had success using DIND. Check out this comprehensive guide on Medium that provides step-by-step instructions on how to run Docker in Docker. Here's the link: [Docker in Docker Guide](https://gopesh3652.medium.com/running-docker-in-docker-dind-a-comprehensive-guide-1fe2e328020). It might have the insights you need to get your setup working!

Yo Motherboard · Answer

For what you're trying to achieve, directly running nested Docker containers is pretty tricky due to networking issues. Your best bet may actually be mounting the socket, but if isolation is crucial, definitely look into using `dind`. Just be aware of the limitations with volume mounts affecting your host filesystem. It's a balancing act!

How can I run an isolated Docker instance inside a Docker container?

Answers

Add your answer

Related Discussions