4 ms·

Docker in docker is a very common pattern in CI, in some cases is the only way to achieve certain tasks.

by nhoughto 6y ago

haberman 6y ago
What kinds of tasks require two levels of containers?
- bogomipz 6y ago
  Your CI server running in a container that is itself executing Docker commands.
  - wwright 6y ago
    As mentioned elsewhere in the thread, this does not require DinD. You can connect to the host’s Docker daemon. (Other interfaces such as K8S are also much safer.)
    - hinkley 6y ago
      Isn't exposing the host Docker daemon the security issue that people grouse about?
      - bogomipz 6y ago
        Yes it is. The Docker socket - /var/run/docker.sock is owned by root and so anyone that has access to it effectively has root on that host. User namespace mitigate this to some degree.
    - bogomipz 6y ago
      Yes and I am one of those people who mentioned elsewhere that this does not require DinD. Please reread the question I am actually responding to which is a general questions "What kinds of tasks ...?" The parent is asking what 'problem is the DinD solution is solving for. You also can not connect to the host's Docker socket if you do not manage that host where Docker is running in the first place.
  - defen 6y ago
    You need more constraints than that to explain why you can't just mount /run/docker.sock in the CI container.
    - bogomipz 6y ago
      If you don't manage your own CI server then that is not an option is it? I also never said that it requires two levels of Docker or that it requires DinD. I was responding to the general question of the parent who was asking a question of someone who was running DinD. I responded to the GP below that Kaniko also solves this problem so clearly I'm not advocating for running DinD or that this is even needed.
    - ryan29 6y ago
      If you mount docker.sock you're building on the runner's daemon so you have to worry about builds interfering with each other. If you use docker-in-docker you get a clean environment every time.
  - joana035 6y ago
    That is the main reason why podman exist, so then one can accomplish that task without an extra daemon, dind, nor using the host's dockerd daemon. This way you don't need to grant "docker" group to the "ci" user and you avoid having your cluster compromised one commit away :)
  - deleted 6y ago
    [deleted]
- iwwr 6y ago
  Ansible Molecule tests depend strictly on Docker: https://molecule.readthedocs.io/en/latest/ https://molecule.readthedocs.io/en/latest/ Also if your application is shipped as orchestrated containers (like docker-compose), or as multiple containers in a 'pod' (e.g. sidecars), you may want the ability to run containers from containers as part of CI.
  - jlgaddis 6y ago
    As of Molecule 3.0, at least -- they didn't in the past. A while ago, I, unfortunately, decided to add "proper tests" to all of my Ansible roles and decided to use Molecule (2.22, at the time, IIRC). As I don't use Docker, I was using "lightweight VMs" I had created (w/ Packer, converted into Vagrant boxes) with VirtualBox for all of this testing. I spent I don't know how many hours across several days learning the "toolchain", getting everything setup and working properly, adding full test coverage, and so on. Not long afterwards, they released Molecule 3.0 which required using Docker. :/
- nhoughto 6y ago
  “kind” is a example in my day to day, how do I run an ephemeral kube cluster in ci to deploy and test my app against without dind/kind? I want N clusters running on 1 host to support many CI jobs. https://github.com/kubernetes-sigs/kind https://github.com/kubernetes-sigs/kind https://github.com/bsycorp/kind https://github.com/bsycorp/kind
  - Nullabillity 6y ago
    FWIW, Kind actually uses CRI-O (same underlying backend as Podman) for the inner containers.
bogomipz 6y ago
There is also Kaniko which works quite well: https://github.com/GoogleContainerTools/kaniko https://github.com/GoogleContainerTools/kaniko

Docker in docker is a very common pattern in CI, in some cases is the only way to achieve certain tasks.

haberman 6y ago

What kinds of tasks require two levels of containers?

bogomipz 6y ago
Your CI server running in a container that is itself executing Docker commands.
- wwright 6y ago
  As mentioned elsewhere in the thread, this does not require DinD. You can connect to the host’s Docker daemon. (Other interfaces such as K8S are also much safer.)
  - hinkley 6y ago
    Isn't exposing the host Docker daemon the security issue that people grouse about?
    - bogomipz 6y ago
      Yes it is. The Docker socket - /var/run/docker.sock is owned by root and so anyone that has access to it effectively has root on that host. User namespace mitigate this to some degree.
  - bogomipz 6y ago
    Yes and I am one of those people who mentioned elsewhere that this does not require DinD. Please reread the question I am actually responding to which is a general questions "What kinds of tasks ...?" The parent is asking what 'problem is the DinD solution is solving for. You also can not connect to the host's Docker socket if you do not manage that host where Docker is running in the first place.
- defen 6y ago
  You need more constraints than that to explain why you can't just mount /run/docker.sock in the CI container.
  - bogomipz 6y ago
    If you don't manage your own CI server then that is not an option is it? I also never said that it requires two levels of Docker or that it requires DinD. I was responding to the general question of the parent who was asking a question of someone who was running DinD. I responded to the GP below that Kaniko also solves this problem so clearly I'm not advocating for running DinD or that this is even needed.
  - ryan29 6y ago
    If you mount docker.sock you're building on the runner's daemon so you have to worry about builds interfering with each other. If you use docker-in-docker you get a clean environment every time.
- joana035 6y ago
  That is the main reason why podman exist, so then one can accomplish that task without an extra daemon, dind, nor using the host's dockerd daemon. This way you don't need to grant "docker" group to the "ci" user and you avoid having your cluster compromised one commit away :)
- deleted 6y ago
  [deleted]
iwwr 6y ago
Ansible Molecule tests depend strictly on Docker: https://molecule.readthedocs.io/en/latest/ https://molecule.readthedocs.io/en/latest/ Also if your application is shipped as orchestrated containers (like docker-compose), or as multiple containers in a 'pod' (e.g. sidecars), you may want the ability to run containers from containers as part of CI.
- jlgaddis 6y ago
  As of Molecule 3.0, at least -- they didn't in the past. A while ago, I, unfortunately, decided to add "proper tests" to all of my Ansible roles and decided to use Molecule (2.22, at the time, IIRC). As I don't use Docker, I was using "lightweight VMs" I had created (w/ Packer, converted into Vagrant boxes) with VirtualBox for all of this testing. I spent I don't know how many hours across several days learning the "toolchain", getting everything setup and working properly, adding full test coverage, and so on. Not long afterwards, they released Molecule 3.0 which required using Docker. :/
nhoughto 6y ago
“kind” is a example in my day to day, how do I run an ephemeral kube cluster in ci to deploy and test my app against without dind/kind? I want N clusters running on 1 host to support many CI jobs. https://github.com/kubernetes-sigs/kind https://github.com/kubernetes-sigs/kind https://github.com/bsycorp/kind https://github.com/bsycorp/kind
- Nullabillity 6y ago
  FWIW, Kind actually uses CRI-O (same underlying backend as Podman) for the inner containers.

bogomipz 6y ago

There is also Kaniko which works quite well: https://github.com/GoogleContainerTools/kaniko https://github.com/GoogleContainerTools/kaniko