Compare Docker-in-Docker (DinD) and Docker-out-of-Docker (DooD) for running Docker builds inside CI/CD containers. What are the security implications of each approach, and what is the modern alternative?
Quick Answer
DinD runs a full Docker daemon inside the CI container (requires --privileged). DooD mounts the host's Docker socket into the CI container (shares the host daemon). Both have security risks. Modern alternatives include Kaniko (daemonless builds), BuildKit with rootless mode, or Podman for daemonless container operations.
Detailed Answer
Docker-in-Docker (DinD)
Runs a complete Docker daemon inside the CI container. The inner daemon has its own image cache, network, and storage. - How: Run with --privileged flag or specific capabilities (SYS_ADMIN, NET_ADMIN) - Pros: Complete isolation, inner containers can't see host containers, clean environment each run - Cons: Requires --privileged (full host kernel access, container escape trivial), performance overhead of nested storage drivers, layer cache is not shared (cold cache every build unless using volume), potential for storage driver conflicts - Security risk: A compromised CI job can escalate to host root access through the privileged container
Docker-out-of-Docker (DooD)
Mounts the host's /var/run/docker.sock into the CI container. CI commands talk to the host's Docker daemon. - How: -v /var/run/docker.sock:/var/run/docker.sock - Pros: Shared layer cache (fast builds), no privileged mode needed for the CI container itself, simpler setup - Cons: CI container can see/kill ALL host containers, can mount host filesystems via Docker, volume mount paths are relative to HOST not CI container, no isolation between concurrent builds - Security risk: Socket access = root on the host. Any container with socket access can docker run -v /:/host --privileged to escape
Modern Alternatives
1. Kaniko: Builds images inside containers without Docker daemon. Runs as unprivileged user, parses Dockerfile and creates layers using filesystem snapshots. Native Kubernetes integration. 2. BuildKit (rootless): Run BuildKit daemon in rootless mode with user namespaces. Secure, fast, supports all Dockerfile features. 3. Podman: Daemonless, rootless container engine. Drop-in replacement for Docker CLI in CI. No socket to mount, no daemon to compromise. 4. Buildah: OCI image builder that doesn't require a daemon. Can build inside unprivileged containers.