Docker-in-Docker considerations in Jenkins - Commands & Configuration

Introduction

Running Docker inside a Docker container helps build and test container images in isolated environments. It solves the problem of needing Docker commands inside CI/CD pipelines without installing Docker on the host directly.

When you want to build Docker images inside a Jenkins pipeline running in a container.

When you need to run integration tests that require Docker containers inside a CI job.

When you want to isolate Docker environments for different builds to avoid conflicts.

When your Jenkins agents do not have Docker installed but you still want to use Docker commands.

When you want to speed up builds by caching Docker layers inside containers.

Config File - Jenkinsfile

Jenkinsfile

pipeline {
  agent {
    docker {
      image 'docker:24.0.5'
      args '--privileged -v /var/run/docker.sock:/var/run/docker.sock'
    }
  }
  stages {
    stage('Build Docker Image') {
      steps {
        sh 'docker build -t my-app-image .'
      }
    }
  }
}

This Jenkinsfile defines a pipeline that runs inside a Docker container using the official Docker image version 24.0.5.

The --privileged flag allows the container to run Docker daemon commands.

The volume mount -v /var/run/docker.sock:/var/run/docker.sock shares the host's Docker socket, enabling Docker commands inside the container to communicate with the host Docker daemon.

This setup avoids running a full Docker daemon inside the container, which is complex and less efficient.

Commands

This command runs a Docker container named 'jenkins-agent' with privileged mode and mounts the host Docker socket. It simulates the Jenkins agent environment that can run Docker commands inside the container.

Terminal

docker run --privileged -d -v /var/run/docker.sock:/var/run/docker.sock --name jenkins-agent docker:24.0.5 sleep infinity

Expected Output

a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0

→

--privileged - Allows the container to run Docker commands that require extended privileges.

→

-v /var/run/docker.sock:/var/run/docker.sock - Shares the host Docker socket with the container to use the host Docker daemon.

→

-d - Runs the container in detached mode.

Runs the 'docker ps' command inside the 'jenkins-agent' container to list running containers using the host Docker daemon.

Terminal

docker exec jenkins-agent docker ps

Expected Output

CONTAINER ID   IMAGE     COMMAND                  CREATED          STATUS          PORTS     NAMES

Builds a Docker image named 'my-app-image' inside the 'jenkins-agent' container using the host Docker daemon.

Terminal

docker exec jenkins-agent docker build -t my-app-image .

Expected Output

Sending build context to Docker daemon  2.048kB

Step 1/2 : FROM alpine:3.18

3.18: Pulling from library/alpine

Digest: sha256:...

Status: Downloaded newer image for alpine:3.18

 ---> abcdef123456

Step 2/2 : CMD ["echo", "Hello from my-app-image"]

 ---> Running in 123456abcdef

Removing intermediate container 123456abcdef

Successfully built 7890abcdef12

Successfully tagged my-app-image:latest

Runs the 'my-app-image' Docker image inside the 'jenkins-agent' container to verify the image was built correctly.

Terminal

docker exec jenkins-agent docker run --rm my-app-image

Expected Output

Hello from my-app-image

→

--rm - Automatically removes the container after it exits.

Key Concept

If you remember nothing else from Docker-in-Docker, remember: mounting the host Docker socket inside a privileged container lets you run Docker commands inside containers without running a full Docker daemon inside them.

Common Mistakes

Running Docker-in-Docker without the --privileged flag

Docker commands inside the container fail due to insufficient permissions.

Always add the --privileged flag when running containers that need to execute Docker commands.

Not mounting the Docker socket from the host

Docker commands inside the container cannot communicate with the Docker daemon, causing failures.

Mount /var/run/docker.sock from the host into the container to share the Docker daemon.

Trying to run a full Docker daemon inside the container without mounting the socket

Running a Docker daemon inside a container is complex, slow, and error-prone.

Use the host Docker daemon by mounting the socket instead of running a daemon inside the container.

Summary

Run Jenkins agents in Docker containers with --privileged and mount the host Docker socket to enable Docker commands inside containers.

Use the official Docker image as the Jenkins agent environment to have Docker CLI tools available.

Verify Docker commands inside the container by running 'docker ps', building images, and running containers using the host Docker daemon.

Practice

1. What is the main purpose of using Docker-in-Docker (DinD) in Jenkins pipelines?

easy

A. To replace Jenkins with Docker

B. To avoid using Docker on the host machine

C. To run Jenkins inside a Docker container

D. To run Docker commands inside a Jenkins container

Solution

1. Step 1: Understand Docker-in-Docker concept

   Docker-in-Docker allows running Docker commands inside a container, enabling containerized builds.

2. Step 2: Relate to Jenkins usage

   In Jenkins pipelines, DinD is used to run Docker commands inside the Jenkins container for building images or running containers.

3. Final Answer:

   To run Docker commands inside a Jenkins container -> Option D

4. Quick Check:

   Docker-in-Docker = run Docker inside container [OK]

Hint: DinD means Docker commands inside a container [OK]

Common Mistakes:

• Confusing DinD with running Jenkins inside Docker
• Thinking DinD replaces Jenkins
• Assuming DinD avoids Docker on host

2. Which Docker run option is required to enable Docker-in-Docker functionality securely?

easy

A. --network host

B. -v /var/run/docker.sock:/var/run/docker.sock

C. --privileged

D. --rm

Solution

1. Step 1: Identify Docker-in-Docker requirements

   DinD requires elevated privileges to run Docker daemon inside a container.

2. Step 2: Match with Docker run options

   The --privileged flag grants the container extended privileges needed for DinD.

3. Final Answer:

   --privileged -> Option C

4. Quick Check:

   DinD needs --privileged flag [OK]

Hint: DinD needs --privileged flag to run Docker daemon [OK]

Common Mistakes:

• Using only volume mount without privileges
• Confusing --network host with privileges
• Assuming --rm affects DinD

3. Given this Jenkins pipeline snippet using Docker-in-Docker:

pipeline {
  agent {
    docker {
      image 'docker:dind'
      args '--privileged'
    }
  }
  stages {
    stage('Build') {
      steps {
        sh 'docker info'
      }
    }
  }
}

What will the docker info command output indicate?

medium

A. Docker daemon is running inside the container

B. Error: Docker command not found

C. Docker daemon is not running

D. Permission denied error

Solution

1. Step 1: Analyze pipeline agent configuration

   The agent uses docker:dind image with --privileged, enabling Docker daemon inside the container.

2. Step 2: Understand docker info behavior

   This command queries the Docker daemon status; with DinD properly set, it shows daemon info.

3. Final Answer:

   Docker daemon is running inside the container -> Option A

4. Quick Check:

   docker:dind + --privileged = Docker daemon running [OK]

Hint: docker:dind with --privileged runs Docker daemon [OK]

Common Mistakes:

• Expecting 'command not found' without checking image
• Assuming daemon is not running without privileges
• Confusing permission errors with missing daemon

4. You configured Jenkins to use Docker-in-Docker but get this error in the build logs: Cannot connect to the Docker daemon. What is the most likely cause?

medium

A. Missing --privileged flag in Docker run command

B. Incorrect Jenkinsfile syntax

C. Docker daemon is not installed on the host

D. Jenkins user lacks permissions to run shell commands

Solution

1. Step 1: Identify error cause

   The error means Jenkins container cannot access Docker daemon inside itself.

2. Step 2: Check Docker-in-Docker setup

   Without --privileged, Docker daemon inside container won't start or be accessible.

3. Final Answer:

   Missing --privileged flag in Docker run command -> Option A

4. Quick Check:

   Cannot connect daemon = missing --privileged [OK]

Hint: Check for --privileged flag if Docker daemon connection fails [OK]

Common Mistakes:

• Blaming Jenkinsfile syntax for daemon connection
• Assuming host Docker installation affects DinD
• Ignoring container privilege requirements

5. You want to run Docker builds inside Jenkins using Docker-in-Docker but want to avoid security risks of --privileged. Which alternative approach is best?

hard

A. Run Jenkins directly on the host without Docker

B. Mount the host Docker socket /var/run/docker.sock into the Jenkins container

C. Use docker:dind image without --privileged

D. Disable Docker usage in Jenkins pipelines

Solution

1. Step 1: Understand security concerns with --privileged

   The --privileged flag grants broad access, which can be risky in shared environments.

2. Step 2: Identify safer alternative

   Mounting the host Docker socket allows Jenkins to use host Docker daemon without needing privileged container.

3. Final Answer:

   Mount the host Docker socket /var/run/docker.sock into the Jenkins container -> Option B

4. Quick Check:

   Socket mount avoids --privileged security risk [OK]

Hint: Mount host Docker socket to avoid --privileged risks [OK]

Common Mistakes:

• Using docker:dind without privileges expecting it to work
• Thinking disabling Docker is a solution
• Assuming running Jenkins on host avoids all risks