0

For CI/CD purposes, I need docker in docker:

docker network create some-network
docker volume create some-docker-certs-ca
docker volume create some-docker-certs-client
docker run --privileged --name some-dind -d --network some-network --network-alias docker -e DOCKER_TLS_CERTDIR=/certs -v some-docker-certs-ca:/certs/ca -v some-docker-certs-client:/certs/client docker:dind

Now if I run the docker:latest image with -it option, I can use docker in the container as expected:

docker run --rm -it --network some-network -e DOCKER_TLS_CERTDIR=/certs -v some-docker-certs-client:/certs/client:ro docker:latest sh

/ # docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
/ #

But I need to customize docker:latest image in a Dockerfile:

FROM docker:latest 

# install package1
# install package2
# install package3
  ...
# install package4

And build the customized docker image:

docker build -t customized-docker .

But when I run the customized-docker image with -it options, It cannot connect to docker daemon:

docker run --rm -it --network some-network -e DOCKER_TLS_CERTDIR=/certs -v some-docker-certs-client:/certs/client:ro customized-docker:latest sh

/ # docker ps
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?
/ #

What is the problem? Isn't there any way I can use customized docker image?

Edit: I found a better way to do my CI/CD without "docker in docker". As David Maze mentioned, most of the times, there is no need to use "docker in docker". But my question still remains: Why can the docker:latest container connect to docker daemon but a customized docker container cannot.

David Maze
  • 130,717
  • 29
  • 175
  • 215
HsnVahedi
  • 1,271
  • 3
  • 13
  • 34
  • `docker:latest` and `docker:dind` are different. But [using DinD for your CI system is generally discouraged](https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/); standard practice is to share the host's Docker socket instead. – David Maze Jan 03 '21 at 16:07
  • @DavidMaze Thanks! I know they are different! But you are right. I found a better way without using "docker in docker". – HsnVahedi Jan 03 '21 at 17:27
  • ...are you trying to use the customized image to be the containerized Docker daemon, or just for a `docker` command-line client calling the other DinD container? I think I might have been confused reading how you were trying to use the custom image. – David Maze Jan 03 '21 at 18:08
  • Does your custom image reset `ENTRYPOINT`? Or `USER`? The standard image has [an entrypoint script](https://github.com/docker-library/docker/blob/a7534626601bce99a23f0496a3f659616522ed22/20.10/docker-entrypoint.sh) that tries to figure out what it's talking to; that you're seeing the error for the unencrypted port 2375 suggests it's not finding your certificates. – David Maze Jan 03 '21 at 18:11
  • @DavidMaze Actually I don't change any of them. I just install some packages. – HsnVahedi Jan 03 '21 at 23:03

0 Answers0