Docker socket mounting in Jenkins - Step-by-Step Execution

Process Flow - Docker socket mounting

Start Jenkins Container

↓

Mount /var/run/docker.sock

↓

Jenkins uses Docker CLI

↓

Docker commands sent to host Docker daemon

↓

Host Docker daemon executes commands

↓

Containers created/managed on host

↓

Jenkins monitors container status

Jenkins container mounts the Docker socket file from the host, allowing Jenkins to control Docker on the host directly.

Execution Sample

Jenkins

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v jenkins_home:/var/jenkins_home \
  jenkins/jenkins:lts

This command runs Jenkins container mounting the Docker socket so Jenkins can run Docker commands on the host.

Process Table

Step	Action	Mount Status	Docker Command Source	Docker Daemon Response	Result
1	Start Jenkins container	Socket not mounted yet	N/A	N/A	Jenkins container initializing
2	Mount /var/run/docker.sock	Socket mounted inside container	Jenkins container	Host Docker daemon ready	Jenkins can send Docker commands
3	Jenkins runs 'docker ps'	Socket mounted	Jenkins container	Host Docker daemon lists containers	Output: list of running containers
4	Jenkins runs 'docker run alpine'	Socket mounted	Jenkins container	Host Docker daemon creates alpine container	New container started on host
5	Jenkins monitors container status	Socket mounted	Jenkins container	Host Docker daemon reports status	Jenkins sees container running
6	Stop Jenkins container	Socket unmounted	N/A	N/A	Jenkins container stops, no Docker control

💡 Jenkins container stops or socket unmounted, Docker commands no longer forwarded

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
Socket Mounted	false	true	true	true	true	false
Docker Command Source	N/A	Jenkins container	Jenkins container	Jenkins container	Jenkins container	N/A
Containers on Host	existing containers	existing containers	existing containers	existing + alpine	existing + alpine	existing + alpine

Key Moments - 3 Insights

Why does Jenkins need the Docker socket mounted?

Mounting the Docker socket allows Jenkins inside the container to send commands directly to the host's Docker daemon, as shown in execution_table step 2 and 3.

What happens if the socket is not mounted?

Without the socket mounted, Jenkins cannot communicate with the host Docker daemon, so Docker commands fail or do nothing, as seen in step 1 where socket is not mounted.

Does mounting the socket give Jenkins full control over host Docker?

Yes, mounting the socket gives Jenkins the same Docker control as the host user, so it can create, stop, and manage containers, as shown in steps 4 and 5.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does Jenkins first successfully run a Docker command?

A Step 3

B Step 2

C Step 4

D Step 1

💡 Hint

Check the 'Docker Command Source' and 'Docker Daemon Response' columns in execution_table rows.

According to variable_tracker, what is the state of 'Socket Mounted' after step 5?

A N/A

B false

C true

D unknown

💡 Hint

Look at the 'Socket Mounted' row and the column 'After Step 5' in variable_tracker.

If the socket was not mounted, how would the 'Docker Command Source' column in execution_table change?

A It would show 'Host Docker daemon' instead of 'Jenkins container'

B It would remain 'Jenkins container' but commands would fail

C It would be 'N/A' for all steps

D It would show 'Jenkins container' and commands succeed

💡 Hint

Consider what happens when Jenkins tries to run Docker commands without socket mounting, referencing step 1 and 2.

Concept Snapshot

Docker socket mounting lets a container (like Jenkins) access the host's Docker daemon.
Mount /var/run/docker.sock from host to container.
This enables running Docker commands inside the container that affect host containers.
Without mounting, Docker commands inside container fail.
Use: docker run -v /var/run/docker.sock:/var/run/docker.sock ...

Full Transcript

Docker socket mounting means sharing the Docker daemon's communication file from the host into a container. When Jenkins runs inside a container, it cannot control Docker on the host unless it has access to the Docker socket file. By mounting /var/run/docker.sock from the host into the Jenkins container, Jenkins can send Docker commands directly to the host's Docker daemon. This allows Jenkins to create, list, and manage containers on the host as if it was running Docker commands locally. The execution steps show starting Jenkins without the socket (no Docker control), then mounting the socket, running Docker commands successfully, and finally stopping Jenkins which removes Docker control. Variables track the socket mount status and containers on the host. Key moments clarify why mounting is needed and the security implications. The quiz tests understanding of when Docker commands succeed and the effect of mounting the socket.

Practice

1. What is the main purpose of mounting the Docker socket /var/run/docker.sock inside a Jenkins container?

easy

A. To allow Jenkins to control Docker on the host machine

B. To increase Jenkins container storage space

C. To isolate Jenkins from the host Docker engine

D. To enable Jenkins to run without Docker installed

Solution

1. Step 1: Understand Docker socket mounting

   Mounting /var/run/docker.sock lets a container communicate with the host's Docker engine directly.

2. Step 2: Apply to Jenkins use case

   Jenkins uses this to build and run Docker containers on the host from inside its own container.

3. Final Answer:

   To allow Jenkins to control Docker on the host machine -> Option A

4. Quick Check:

   Docker socket mounting = Jenkins controls host Docker [OK]

Hint: Docker socket mounting = container controls host Docker [OK]

Common Mistakes:

• Thinking it increases container storage
• Assuming it isolates Jenkins from Docker
• Believing it removes need for Docker installation

2. Which of the following is the correct Docker run command snippet to mount the Docker socket inside a Jenkins container?

easy

A. docker run -v /var/run/docker.sock:/var/run/docker jenkins

B. docker run -v /var/run/docker.sock:/docker.sock jenkins

C. docker run -v /docker.sock:/var/run/docker.sock jenkins

D. docker run -v /var/run/docker.sock:/var/run/docker.sock jenkins

Solution

1. Step 1: Identify correct volume mount syntax

   The syntax is -v host_path:container_path. The Docker socket is at /var/run/docker.sock on the host and must be mounted to the same path inside the container.

2. Step 2: Match correct paths

   docker run -v /var/run/docker.sock:/var/run/docker.sock jenkins correctly mounts /var/run/docker.sock from host to container at the same path.

3. Final Answer:

   docker run -v /var/run/docker.sock:/var/run/docker.sock jenkins -> Option D

4. Quick Check:

   Correct volume mount syntax = docker run -v /var/run/docker.sock:/var/run/docker.sock jenkins [OK]

Hint: Mount socket with same host and container path [OK]

Common Mistakes:

• Swapping host and container paths
• Using incorrect socket path inside container
• Missing /var/run prefix

3. Given this Jenkins Docker run command:

docker run -d -v /var/run/docker.sock:/var/run/docker.sock jenkins

What will happen if Jenkins tries to run docker ps inside its container?

medium

A. It will show an error: Docker command not found

B. It will list running Docker containers on the host

C. It will list containers inside the Jenkins container only

D. It will fail because Docker daemon is not running inside Jenkins

Solution

1. Step 1: Understand socket mount effect

   Mounting the Docker socket lets Jenkins use the host's Docker daemon, so commands like docker ps run inside Jenkins actually query the host Docker.

2. Step 2: Predict command output

   Therefore, docker ps inside Jenkins will list containers running on the host, not inside Jenkins container.

3. Final Answer:

   It will list running Docker containers on the host -> Option B

4. Quick Check:

   Docker socket mount = host Docker commands inside container [OK]

Hint: Docker socket mount = host Docker commands work inside container [OK]

Common Mistakes:

• Thinking Docker runs inside Jenkins container
• Assuming Docker command is missing
• Confusing container vs host Docker context

4. You mounted the Docker socket in Jenkins container but get permission denied errors when running Docker commands inside Jenkins. What is the likely cause?

medium

A. Jenkins user inside container lacks permission to access the socket

B. Docker daemon is not installed on the host

C. The socket path inside container is incorrect

D. Jenkins container network is disconnected

Solution

1. Step 1: Analyze permission error cause

   The Docker socket file on the host has restricted permissions. If Jenkins runs as a user without access rights, it will get permission denied.

2. Step 2: Confirm other options

   Docker daemon must be running on host (else other errors). Socket path is correct if mounted. Network issues don't cause permission denied on socket.

3. Final Answer:

   Jenkins user inside container lacks permission to access the socket -> Option A

4. Quick Check:

   Permission denied = user lacks socket access [OK]

Hint: Check Jenkins user permissions on Docker socket [OK]

Common Mistakes:

• Blaming Docker daemon absence
• Assuming wrong socket path
• Confusing network issues with permissions

5. You want Jenkins to build Docker images inside its container using the host Docker engine. Which combination of steps is the safest and most effective approach?

hard

A. Mount /var/run/docker.sock and run Jenkins as root user inside container

B. Install Docker daemon inside Jenkins container and do not mount socket

C. Mount /var/run/docker.sock and add Jenkins user to Docker group on host and container

D. Use Docker-in-Docker (DinD) without mounting socket

Solution

1. Step 1: Understand mounting socket and permissions

   Mounting the Docker socket allows Jenkins to use host Docker. Running as root is risky and not recommended.

2. Step 2: Apply best practice for permissions

   Adding Jenkins user to Docker group on host and container grants needed permissions safely without root.

3. Step 3: Evaluate alternatives

   Installing Docker daemon inside Jenkins container duplicates effort and complicates setup. DinD is more complex and less secure.

4. Final Answer:

   Mount /var/run/docker.sock and add Jenkins user to Docker group on host and container -> Option C

5. Quick Check:

   Socket mount + Docker group permissions = safe Jenkins Docker use [OK]

Hint: Use socket mount + Docker group permissions, avoid root [OK]

Common Mistakes:

• Running Jenkins as root inside container
• Installing Docker daemon inside Jenkins container
• Using DinD without understanding risks