[archived] "Docker-in-Docker using sidecars" docs discussion

[giscus[bot]]

en/latest/walk-through/docker-in-docker-using-sidecars/

https://argo-workflows.readthedocs.io/en/latest/walk-through/docker-in-docker-using-sidecars/

[joebowbeer]

Is the Note relevant to the example? It looks like the example is running the docker daemon in a sidecar.

Below is an example of dind running in a Pod in EKS 1.24

testcontainers/testcontainers-java#1135 (comment)

I think dind can run on any CRI runtime.

[agilgur5]

The Note is a disclaimer basically that the following may not work. It should actually be changed to a !!! Warning admonition though (c.f. #12561).

I think dind can run on any CRI runtime.

It requires Docker, which not all CRIs include. Part of the reason the CRI spec was made was to decouple the Docker runtime.

[joebowbeer]

My claim is that dind, despite the name, only requires a CRI-compatible runtime.

That's why it is listed as an option in the migration guide:

docker:dind (Docker-in-Docker) container build images

• This is a container image(docker:dind), which has sock pre-packaged within the image and the docker daemon runs within the container.
• This can be used purely for the purpose of building container images using Docker CLI.
• But this approach requires you to configure this pod with elevated privileges. Hence, its recommended to adapt to one of the approaches mentioned above.

https://aws.amazon.com/blogs/containers/all-you-need-to-know-about-moving-to-containerd-on-amazon-eks/

The link to the testcontainers example above is running dind as a sidecar in k8s 1.24, which has no docker shim, right?

In other words, the Argo Workflows example that runs dind in a sidecar should still work.

[agilgur5]

Thanks for providing the link! Interesting, I didn't know you could do this without Docker Engine; docker:dind runs it from inside the container instead.

@tico24's done the most image building in k8s and added this note in #10778, perhaps he didn't know about this? It was always the DinD specific image in the example

Below is an example of dind running in a Pod in EKS 1.24

The link to the testcontainers example above is running dind as a sidecar in k8s 1.24, which has no docker shim, right?

You said it was in EKS before, so I wasn't sure if that might be EKS specific. Given the AWS blog link you provided above, I guess it doesn't then.

[agilgur5]

I DM'd Tim who hasn't had time to check here but indeed he wasn't aware of this. The :dind tag is a bit subtle and I didn't notice it initially either. @joebowbeer do you want to submit a PR to remove the note from the docs? Especially if you've confirmed that DinD works on later k8s versions?

[agilgur5]

@joebowbeer do you want to submit a PR to remove the note from the docs?

I wrote up #13781 to cover this

[joebowbeer]

You said it was in EKS before, so I wasn't sure if that might be EKS specific. Given the AWS blog link you provided above, I guess it doesn't then.

Right. Sorry for the confusion. EKS removed dockershim when everyone else did. I'm looking for a way to run testcontainers in Argo Workflows, and I was surprised by this warning, because I think dind should still work.