Is it safe to run docker in docker on Openshift?

Question

I built Docker image on server that can run CI-CD for Jenkins. Because some builds use Docker, I installed Docker inside my image, and in order to allow the inside Docker to run, I had to give it --privilege .

All works good, but I would like to run the docker in docker, on Openshift (or Kubernetes). The problem is with getting the --privilege permissions.

Is running privilege container on Openshift is dangerous, and if so why and how much?

Answer 1

A privileged container can reboot the host, replace the host's kernel, access arbitrary host devices (like the raw disk device), and reconfigure the host's network stack, among other things . I'd consider it extremely dangerous, and not really any safer than running a process as root on the host.

I'd suggest that using --privileged at all is probably a mistake. If you really need a process to administer the host, you should run it directly (as root) on the host and not inside an isolation layer that blocks the things it's trying to do. There are some limited escalated-privilege things that are useful, but if eg your container needs to mlock (2) you should --cap-add IPC_LOCK for the specific privilege you need, instead of opening up the whole world.

(My understanding is still that trying to run Docker inside Docker is generally considered a mistake and using the host's Docker daemon is preferable. Of course, this also gives unlimited control over the host...)

Answer 2

In short, the answer is no, it's not safe. Docker-in-Docker in particular is far from safe due to potential memory and file system corruption, and even mounting the host's docker socket is unsafe in effectively any environment as it effectively gives the build pipeline root privileges. This is why tools like Buildah and Kaniko were made, as well as build images like S2I.

Buildah in particular is Red Hat's own tool for building inside containers but as of now I believe they still can't run completely privilege-less.

Additionally, on Openshift 4, you cannot run Docker-in-Docker at all since the runtime was changed to CRI-O.