Hacker News Reader

I've seen people who use testcontainers and run their CI workloads in containers abusing the docker.sock mounting so they can spin up the tests. The anti-pattern of using docker.sock has been always a threat because when docker got popularity in CI/CD systems it was the easiest way to have a platform independent way to spin up isolated environments. In my perception, this was a very common pattern in Jenkins a few years ago.

View on HN

A workaround for this is to run Docker Engine inside a (non-Docker) container and use that container's socket. The Docker containers become processes within the Docker Engine container.

AFAIK you can't do that without giving the Docker-in-Docker container privileged permissions, which allows escaping.

You can do what Docker Desktop does- put the whole thing in a VM :^)

You still can't run untrusted code but at least you can isolate stuff like Compose environments

Reply on news.ycombinator.com