Random docker behavior inside a container

General
,
1

Hello everyone,
I’m developing an emulator for a wifi network and I’m trying to install docker on containers and then use them as swarm nodes. The problem is that when I use the following script to install docker and then start the daemon, it randomly shows the following error:

“Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?”

and when I run dockerd manually, sometimes it says:
timeout waiting for containerd to start and sometimes it gives permission denied for iptables.

but when I’m inside the container, I am already root so I don’t know what the problem is. When I run it with --privileged=true, it works fine but for my emulator purposes, I can’t create the containers manually to use the privileged flag.
The docker status is running and the weird thing is that this sometimes happens and sometimes works fine when I recreate the containers. I can’t figure out if it happens randomly or if I can’t see the underlying reason.

I’ve already tried adding user to the group, updating iptables, changing the docker version, starting containerd and dockerd manually, and I’ve tried using it with different base images but nothing worked.
Another point to mention is that I can’t use volumes because I want containers to be isolated as swarm nodes and not share the same docker.sock so that they can behave like individual nodes.
The base image for my container is brunneis/python:3.8.3-ubuntu-20.04 and I have tried it on ubuntu virtualbox and also on docker windows but the problem remained the same.
This is the script I’m using to install docker:

apt-get update
apt-get install -y \
    ca-certificates \
    curl \
    gnupg \
    lsb-release

mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
apt-get update
apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Thank you in advance for any help and insight you can offer.

2

I formatted your message. Please, next time format your post according to the following guide: How to format your forum posts
In short: please, use </> button to share codes, terminal outputs, error messages or anything that can contain special characters which would be interpreted by the MarkDown filter. Use the preview feature to make sure your text is formatted as you would expect it and check your post after you have sent it so you can still fix it.

Example code block:

```
echo "I am a code."
echo "An athletic one, and I wanna run."
```

Looks like you want to use containers as virtual machines and install Docker in the container as you would in a VM. Don’t. Use the official dind base image and yes, you will need privileged mode as far as I know. Containers are isolated processes (mainly) and you don’t have full access to the kernel. That’s the point and containers rely on the isolation done by the kernel (kernel namespaces).

3

Thank you for formatting my message. Regarding your answer, I’m not using dind, and I must say what’s weird is that even when I don’t use the privileged mode, sometimes it works as expected and this random behavior is why it has become so difficult to troubleshoot my problem. And I’ve tried privileged mode to test different scenarios. For my development purposes, I can’t run containers from the terminal and instead, they are created dynamically using pre-built functions so I can’t use the privileged flag.

4

A requirement is a requiement and not because of you use or not use a specific image, but because the feature requires it. DinD means Docker in Docker. You want to use a container as a Swarm node which requires the Docker daemon in the container so that is technically DinD even if you don’t use the official image.

I can’t tell you why your solution works randomly, but based on what you shared, it is surprising that it works at all.

So far you shared only the apt commands. If you can share the Dockerfile any everything that is required to reproduce the issue, someone could try it but I would just use the official image since the requirements will not be different but that is already properly built.