Can docker run inside a Linux Container?
Yes, it is possible. However, you can't have an aufs partition nested within aufs. You need to mount an other system or use a different storage backend.
You can take a look at the docker's makefile and hack/dind
. You need the privileged mode in order to do so.
The easiest way to try is to do make shell
and once in the container, you can start a new docker daemon :)
EDIT: I tried Koding and it indeed not possible. You are not privileged within their container so you can't start a new docker.
Yes, docker can run in a linux container.
But docker will only run with the lxc
execution driver and in a unconfined lxc.
So, here's how to get docker in LXC:
Ensure you have
lxc.aa_profile = lxc-container-default-with-nesting
(if it doesn't work or you don't have this profile, trylxc.aa_profile = unconfined
) in theconfig
file of your LXC to ensure it will not be blocked byapparmor
. For more information, visit (or modify) files in/etc/apparmor.d/lxc
.You need to install lxc in your container. If you are under ubuntu for instance, run in the container
apt-get install lxc
.Ensure that docker daemon is called with the
--exec-driver=lxc
parameter. You can test it before by issuing manualydocker -d --exec-driver=lxc
. In ubuntu, to have the argument being used at startup, simply edit/etc/default/docker
and ensure that you have the line:
DOCKER_OPTS="--exec-driver=lxc"
Follow this thread for updates: https://github.com/docker/docker/issues/6783
If you need to troubleshoot:
- keep an eye on
apparmor
logs in the kern logs of the host. - launch
docker -d ...
manualy to get outputs.
Note: You might not have hand on the host to modify the LXC apparmor script on Koding by judging others answers, anyway, this howto remains of interest if you are the LXC provider, and it answers the more general question you've asked in your question's title and that might attract people in more general scenarios (as I was).
And here is a full guide for anyone else in the same boat.
Start a terminal and start typing..
docker run -i -t --privileged -v /var/lib/docker ubuntu bash
apt-get update && apt-get install -y docker.io
service docker.io start
ln -s /usr/bin/docker.io /usr/local/bin/docker
docker run -i -t ubuntu bash
Now you should be inside a container inside an other container.
Remarks:
- The flag
--privileged
is needed on the outer container to accomplish that. - You MUST use
-v /var/lib/docker
to avoid the limitation mentioned by creack. ln -s /usr/bin/docker.io /usr/local/bin/docker
is just creating a symbolic link so that we can typedocker
instead ofdocker.io