3 ms·
I've seen people who use testcontainers and run their CI workloads in containers abusing the docker.sock mounting so they can spin up the tests. The anti-patter
by clvx 3y ago
I've seen people who use testcontainers and run their CI workloads in containers abusing the docker.sock mounting so they can spin up the tests.
The anti-pattern of using docker.sock has been always a threat because when docker got popularity in CI/CD systems it was the easiest way to have a platform independent way to spin up isolated environments. In my perception, this was a very common pattern in Jenkins a few years ago.
- dharmab 3y agoA workaround for this is to run Docker Engine inside a (non-Docker) container and use that container's socket. The Docker containers become processes within the Docker Engine container.
- remram 3y agoAFAIK you can't do that without giving the Docker-in-Docker container privileged permissions, which allows escaping.
- dharmab 3y agoYou can do what Docker Desktop does- put the whole thing in a VM :^) You still can't run untrusted code but at least you can isolate stuff like Compose environments