Skip to content

Consider binding to Docker socket rather than using Docker-in-Docker

Summary

Using Docker-in-Docker is not advised, and has some potential problems. We currently recommend it as one of the options for being able to manipulate docker images within GitLab CI. Bind the docker socket instead.

From Stefan Asseg:

Actually, all of this can (and should, if you ask me) be done without Docker-in-Docker. There is no need for the Docker privileged flag and no need for docker:dind. Here's an excellent article why one should stay away from using Docker-in-Docker: https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/

I am using "--docker-volumes /var/run/docker.sock:/var/run/docker.sock" instead of --docker-privileged when registering my gitlab-runner and I am able to run Docker commands such as docker build or docker push in my CI scripts just fine.

Possible fixes

Here's my complete gitlab-runner register command:

docker exec gitlab-runner gitlab-runner register \
           --non-interactive \
           --url https://gitlab.com/ci \
           --registration-token TOKEN\
           --description "Docker Runner" \
           --tag-list "docker" \
           --executor docker \
           --docker-image "docker:latest" \
           --docker-volumes /var/run/docker.sock:/var/run/docker.sock