Answers: <p>Although this is a working solution (I use it myself), there some drawbacks for running Docker in a Kubernetes pod by mounting <code>/var/run/docker.sock</code></p>
  
  <p>Mostly the fact you are working with Docker containers outside the control of Kubernetes.</p>
  
  <p>Another suggested solution I found is using a <strong>side-car</strong> container in your pod. See <a href="https://applatix.com/case-docker-docker-kubernetes-part/" rel="nofollow noreferrer">A Case for Docker-in-Docker on Kubernetes</a>. There are two parts to it where the proposed solution is in <a href="https://applatix.com/case-docker-docker-kubernetes-part-2/" rel="nofollow noreferrer">part 2</a>.</p>
  
  <p>I hope this helps.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-02-12T07:55:30.403Z
Answers: 2018-02-12T07:55:30.403Z
Answers: Eldad Assis
Answers: <p>Unverified as it sounds brittle to me to start a container outside of k8s supervision, but you should be able to mount <code>/var/run/docker.sock</code> with a <a href="https://kubernetes.io/docs/concepts/storage/volumes/#hostpath" rel="noreferrer">hostPath volume</a>.</p>
  
  <p>Example variation from the documentation:</p>
  
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: test-pd
  spec:
    containers:
    - image: gcr.io/google_containers/test-webserver
      name: test-container
      volumeMounts:
      - mountPath: /var/run/docker.sock
        name: docker-sock-volume
    volumes:
    - name: docker-sock-volume
      hostPath:
        # location on host
        path: /var/run/docker.sock
        # this field is optional
        type: File
  </code></pre>
  
  <p>I think a simple mount should be enough to allow communication from docker client within the container to docker daemon on host but in case you get a write permission error it means you need to run your container as privileged container
   using a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container" rel="noreferrer">securityContext</a> object like such (just an extract from above to show the addition, values taken from <a href="https://kubernetes.io/docs/api-reference/v1.8/#securitycontext-v1-core" rel="noreferrer">the documentation</a>):</p>
  
  <pre><code>spec:
    containers:
    - image: gcr.io/google_containers/test-webserver
      securityContext:
        privileged: true
      name: test-container
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-11-07T17:23:43.813Z
Answers: This worked, thanks. Yeah it is a third party tool so it is not ideal. But I at least want the main container in Kubernetes to make it more reliable. The container ramps up temporary containers with browsers for automation UI testing, then the browser container is destroyed.
Answers: rys
Answers: CC BY-SA 3.0
Answers: 2017-11-08T06:55:40.360Z
Answers: @rys yes, that was a case I had think of, you may still run into problems if the node load goes too high as k8s may move your 'launcher' container. But I assume the failure of the test suite is something acceptable in this case
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2022-12-14T22:07:21.563Z
Answers: This is no longer supported https://cloud.google.com/kubernetes-engine/docs/deprecations/docker-containerd. You can use sidecar dind or k8s jobs. I have the exact same problem and honestly the community has been very hostile when I've asked about this lol here's me trying to get an answer: https://www.reddit.com/r/kubernetes/comments/yrf215/eks_ive_been_struggling_with_the_upcoming_removal/
Answers: Shanteva
Answers: CC BY-SA 4.0
Answers: 2022-12-15T06:12:27.473Z
Answers: The question was specifically about a k8s using docker as container runtime. Kubernetes has moved away from only docker to a CRI interface so obviously it won't apply to managed k8s not using docker as CRI.
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-11-07T16:06:31.190Z
Answers: 2017-11-08T06:53:44.347Z
Answers: 2017-11-08T06:53:44.347Z
Answers: Tensibai
Body: <p>I am using a third party library that creates sibling docker containers via:</p>
  
  <pre><code>docker run -d /var/run/docker.sock:/var/run/docker.sock ...
  </code></pre>
  
  <p>I am trying to create a Kubernetes deployment out of the above container, but currently getting:</p>
  
  <blockquote>
    <p>Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?</p>
  </blockquote>
  
  <p>This is expected because I am not declaring <code>/var/run/docker.sock</code> as a volume in the deployment yaml.</p>
  
  <p>The problem is I don't know how to do this. Is it possible to mount <code>/var/run/docker.sock</code> as a volume in a deployment yaml?</p>
  
  <p>If not, what is the best approach to run docker sibling-containers from within a Kubernetes deployment/pod?</p>
  
Tags: <kubernetes><docker-in-docker>
Title: Docker In Kubernetes Deployment
UserDisplayName: rys
ThreadText: # Docker In Kubernetes Deployment
  
  (Asked by: username_0 on 2017-11-07)
  
  I am using a third party library that creates sibling docker containers via:
  
  ```
  docker run -d /var/run/docker.sock:/var/run/docker.sock ...
  
  ```
  
  I am trying to create a Kubernetes deployment out of the above container, but currently getting:
  
  > Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
  
  This is expected because I am not declaring `/var/run/docker.sock` as a volume in the deployment yaml.
  
  The problem is I don't know how to do this. Is it possible to mount `/var/run/docker.sock` as a volume in a deployment yaml?
  
  If not, what is the best approach to run docker sibling-containers from within a Kubernetes deployment/pod?
  
  **Tags:** kubernetes, docker-in-docker
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-11-07. Score: 22 | Accepted answer
  
  Unverified as it sounds brittle to me to start a container outside of k8s supervision, but you should be able to mount `/var/run/docker.sock` with a [hostPath volume](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath).
  
  Example variation from the documentation:
  
  ```
  apiVersion: v1
  kind: Pod
  metadata:
    name: test-pd
  spec:
    containers:
    - image: gcr.io/google_containers/test-webserver
      name: test-container
      volumeMounts:
      - mountPath: /var/run/docker.sock
        name: docker-sock-volume
    volumes:
    - name: docker-sock-volume
      hostPath:
        # location on host
        path: /var/run/docker.sock
        # this field is optional
        type: File
  
  ```
  
  I think a simple mount should be enough to allow communication from docker client within the container to docker daemon on host but in case you get a write permission error it means you need to run your container as privileged container
  using a [securityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) object like such (just an extract from above to show the addition, values taken from [the documentation](https://kubernetes.io/docs/api-reference/v1.8/#securitycontext-v1-core)):
  
  ```
  spec:
    containers:
    - image: gcr.io/google_containers/test-webserver
      securityContext:
        privileged: true
      name: test-container
  
  ```
  
  > **Comments:**
  > **username_0**: This worked, thanks. Yeah it is a third party tool so it is not ideal. But I at least want the main container in Kubernetes to make it more reliable. The container ramps up temporary containers with browsers for automation UI testing, then the browser container is destroyed.  
  > **username_2**: @username_0 yes, that was a case I had think of, you may still run into problems if the node load goes too high as k8s may move your 'launcher' container. But I assume the failure of the test suite is something acceptable in this case  
  > **username_3**: This is no longer supported https://cloud.google.com/kubernetes-engine/docs/deprecations/docker-containerd. You can use sidecar dind or k8s jobs. I have the exact same problem and honestly the community has been very hostile when I've asked about this lol here's me trying to get an answer: https://www.reddit.com/r/kubernetes/comments/yrf215/eks_ive_been_struggling_with_the_upcoming_removal/  
  > **username_2**: The question was specifically about a k8s using docker as container runtime. Kubernetes has moved away from only docker to a CRI interface so obviously it won't apply to managed k8s not using docker as CRI.  
  
  ---
  
  ### Answer by username_1 on 2018-02-12. Score: 3
  
  Although this is a working solution (I use it myself), there some drawbacks for running Docker in a Kubernetes pod by mounting `/var/run/docker.sock`
  
  Mostly the fact you are working with Docker containers outside the control of Kubernetes.
  
  Another suggested solution I found is using a **side-car** container in your pod. See [A Case for Docker-in-Docker on Kubernetes](https://applatix.com/case-docker-docker-kubernetes-part/). There are two parts to it where the proposed solution is in [part 2](https://applatix.com/case-docker-docker-kubernetes-part-2/).
  
  I hope this helps.
  
  
  ---
  
  