<p>Although this is a working solution (I use it myself), there some drawbacks for running Docker in a Kubernetes pod by mounting <code>/var/run/docker.sock</code></p>

<p>Mostly the fact you are working with Docker containers outside the control of Kubernetes.</p>

<p>Another suggested solution I found is using a <strong>side-car</strong> container in your pod. See <a href="https://applatix.com/case-docker-docker-kubernetes-part/" rel="nofollow noreferrer">A Case for Docker-in-Docker on Kubernetes</a>. There are two parts to it where the proposed solution is in <a href="https://applatix.com/case-docker-docker-kubernetes-part-2/" rel="nofollow noreferrer">part 2</a>.</p>

<p>I hope this helps.</p>

CC BY-SA 3.0
2018-02-12T07:55:30.403Z
2018-02-12T07:55:30.403Z
Eldad Assis
<p>Unverified as it sounds brittle to me to start a container outside of k8s supervision, but you should be able to mount <code>/var/run/docker.sock</code> with a <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="noreferrer">hostPath volume</a>.</p>

<p>Example variation from the documentation:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: gcr.io/google_containers/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /var/run/docker.sock
      name: docker-sock-volume
  volumes:
  - name: docker-sock-volume
    hostPath:
      # location on host
      path: /var/run/docker.sock
      # this field is optional
      type: File
</code></pre>

<p>I think a simple mount should be enough to allow communication from docker client within the container to docker daemon on host but in case you get a write permission error it means you need to run your container as privileged container
 using a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container" rel="noreferrer">securityContext</a> object like such (just an extract from above to show the addition, values taken from <a href="https://kubernetes.io/docs/api-reference/v1.8/#securitycontext-v1-core" rel="noreferrer">the documentation</a>):</p>

<pre><code>spec:
  containers:
  - image: gcr.io/google_containers/test-webserver
    securityContext:
      privileged: true
    name: test-container
</code></pre>

CC BY-SA 3.0
2017-11-07T17:23:43.813Z
This worked, thanks. Yeah it is a third party tool so it is not ideal. But I at least want the main container in Kubernetes to make it more reliable. The container ramps up temporary containers with browsers for automation UI testing, then the browser container is destroyed.
rys
CC BY-SA 3.0
2017-11-08T06:55:40.360Z
@rys yes, that was a case I had think of, you may still run into problems if the node load goes too high as k8s may move your 'launcher' container. But I assume the failure of the test suite is something acceptable in this case
Tensibai
CC BY-SA 4.0
2022-12-14T22:07:21.563Z
This is no longer supported https://cloud.google.com/kubernetes-engine/docs/deprecations/docker-containerd. You can use sidecar dind or k8s jobs. I have the exact same problem and honestly the community has been very hostile when I've asked about this lol here's me trying to get an answer: https://www.reddit.com/r/kubernetes/comments/yrf215/eks_ive_been_struggling_with_the_upcoming_removal/
Shanteva
CC BY-SA 4.0
2022-12-15T06:12:27.473Z
The question was specifically about a k8s using docker as container runtime. Kubernetes has moved away from only docker to a CRI interface so obviously it won't apply to managed k8s not using docker as CRI.
Tensibai
CC BY-SA 3.0
2017-11-07T16:06:31.190Z
2017-11-08T06:53:44.347Z
2017-11-08T06:53:44.347Z
Tensibai
<p>I am using a third party library that creates sibling docker containers via:</p>

<pre><code>docker run -d /var/run/docker.sock:/var/run/docker.sock ...
</code></pre>

<p>I am trying to create a Kubernetes deployment out of the above container, but currently getting:</p>

<blockquote>
  <p>Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?</p>
</blockquote>

<p>This is expected because I am not declaring <code>/var/run/docker.sock</code> as a volume in the deployment yaml.</p>

<p>The problem is I don't know how to do this. Is it possible to mount <code>/var/run/docker.sock</code> as a volume in a deployment yaml?</p>

<p>If not, what is the best approach to run docker sibling-containers from within a Kubernetes deployment/pod?</p>

<kubernetes><docker-in-docker>
Docker In Kubernetes Deployment
rys
# Docker In Kubernetes Deployment

(Asked by: username_0 on 2017-11-07)

I am using a third party library that creates sibling docker containers via:
docker run -d /var/run/docker.sock:/var/run/docker.sock ...

I am trying to create a Kubernetes deployment out of the above container, but currently getting:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

This is expected because I am not declaring /var/run/docker.sock as a volume in the deployment yaml.
The problem is I don't know how to do this. Is it possible to mount /var/run/docker.sock as a volume in a deployment yaml?
If not, what is the best approach to run docker sibling-containers from within a Kubernetes deployment/pod?

**Tags:** kubernetes, docker-in-docker


---

## 2 answers

### Answer by username_2 on 2017-11-07. Score: 22 | Accepted answer

Unverified as it sounds brittle to me to start a container outside of k8s supervision, but you should be able to mount /var/run/docker.sock with a hostPath volume.
Example variation from the documentation:
apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: gcr.io/google_containers/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /var/run/docker.sock
      name: docker-sock-volume
  volumes:
  - name: docker-sock-volume
    hostPath:
      # location on host
      path: /var/run/docker.sock
      # this field is optional
      type: File

I think a simple mount should be enough to allow communication from docker client within the container to docker daemon on host but in case you get a write permission error it means you need to run your container as privileged container
 using a securityContext object like such (just an extract from above to show the addition, values taken from the documentation):
spec:
  containers:
  - image: gcr.io/google_containers/test-webserver
    securityContext:
      privileged: true
    name: test-container

> **Comments:**
> **username_0**: This worked, thanks. Yeah it is a third party tool so it is not ideal. But I at least want the main container in Kubernetes to make it more reliable. The container ramps up temporary containers with browsers for automation UI testing, then the browser container is destroyed.  
> **username_2**: @username_0 yes, that was a case I had think of, you may still run into problems if the node load goes too high as k8s may move your 'launcher' container. But I assume the failure of the test suite is something acceptable in this case  
> **username_3**: This is no longer supported https://cloud.google.com/kubernetes-engine/docs/deprecations/docker-containerd. You can use sidecar dind or k8s jobs. I have the exact same problem and honestly the community has been very hostile when I've asked about this lol here's me trying to get an answer: https://www.reddit.com/r/kubernetes/comments/yrf215/eks_ive_been_struggling_with_the_upcoming_removal/  
> **username_2**: The question was specifically about a k8s using docker as container runtime. Kubernetes has moved away from only docker to a CRI interface so obviously it won't apply to managed k8s not using docker as CRI.  

---

### Answer by username_1 on 2018-02-12. Score: 3

Although this is a working solution (I use it myself), there some drawbacks for running Docker in a Kubernetes pod by mounting `/var/run/docker.sock`

Mostly the fact you are working with Docker containers outside the control of Kubernetes.

Another suggested solution I found is using a **side-car** container in your pod. See [A Case for Docker-in-Docker on Kubernetes](https://applatix.com/case-docker-docker-kubernetes-part/). There are two parts to it where the proposed solution is in [part 2](https://applatix.com/case-docker-docker-kubernetes-part-2/).

I hope this helps.


---

