Painless Docker - 2nd Edition

Running Docker in Docker

Sometimes, you may need to run Docker inside a Docker container. This is commonly referred to as "Docker-in-Docker" (DinD). There are several use cases for this approach, such as testing Docker images, running CI/CD pipelines, or isolating Docker environments.

Jérôme Petazzoni suggested different methods to achieve Docker-in-Docker functionality, each with its own advantages and disadvantages. The most common method is to share the Docker socket from the host machine with the container.

To understand this, let's step back to how Docker works. Docker uses a client-server architecture where the Docker client communicates with the Docker daemon (server) to manage containers and images. The Docker daemon listens on a Unix socket (/var/run/docker.sock) or a TCP port. Let's imagine we have a Dockerized application that needs to build and run other Docker containers like a Jenkins CI server.

When we run this image as a container, we will share the Docker socket from the host machine with the container. In this way, the Docker client inside the container, when it communicates with the Docker daemon, will actually be communicating with the Docker daemon of the host machine. This allows the container to create and manage other containers. In other words, when Jenkins wants to run container A, it sends the request to the Docker daemon of the host machine, which then creates and manages container A. The Docker instance inside the Jenkins container will just use its client (not its own daemon) and leverage the host's Docker daemon. Using the host's Docker daemon is the easiest and most effective way to launch and manage Docker containers from a Docker container.

The following image eon01/jenkins_dind is a Jenkins server with Docker installed inside it. Let's run it using the Docker socket from the host machine:

docker run \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -dit --name jenkins_dind eon01/jenkins_dind

Launch a container from inside the Jenkins container: