Azure-docs: How to run docker inside azure container instance?

[iocuydi]

Hi, how can I run docker commands such as building a docker image, inside an azure container instance, that is itself running a docker image?

According to this link: https://stackoverflow.com/questions/52973546/docker-in-docker-in-aks

you can do this in AKS by mounting /var/run/docker.sock with hostpath. However there is no hostpath param for ACI. Is there any equivalent operation for ACI?

This issue: https://github.com/Microsoft/azure-pipelines-agent/issues/2056 seems to suggest this can be done by specifying "options" but as far as I can tell there is no options command for ACI either.

Clearly docker is running on the vm, how can I get this docker in docker functionality for ACI?

Thanks!!

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 5c00e2ca-c968-c339-c4f2-6acebc9c4f2f
• Version Independent ID: 46b156b3-b879-22ba-3194-1655137ae127
• Content: Serverless containers in Azure - Azure Container Instances
• Content Source: articles/container-instances/container-instances-overview.md
• Service: container-instances
• GitHub Login: @dlepow
• Microsoft Alias: danlep

[Balakrishna625]

Hello @iocuydi
To run your docker image inside ACI, You can use of Azure Container Registry.
step0: Create Azure Container Registry
step1: Include a Dockerfile in your application code
step2: Build the code along with Dockerfile with a tag and create a Docker image ( docker build -t imagename:tag )
step3: Push the Docker image to Azure container Registry with a image name and tag
step4: Now create a ACI, while creating, choose the image type as private, provide the image name, tag, image registry login server, image registry username, image registry password ( these details can be found under access keys tab inside Azure Container Registry)
step5: choose running os as linux, in network step you can give an dns name for your ACI, then click on review & create
step6: once ACI gets created you can go to overview and you can see fqdn, using fqdn you can access your application running inside Azure Container Instance.

[AshokPeddakotla-MSFT]

@iocuydi Please help with the link of document on which above document feedback request is created.
Under this repository we want to make sure any issue is linked to a doc so we can help others that may be having the same issue.

[iocuydi]

@Balakrishna625 I want to be able to run docker commands inside my ACI. For example, in my ACI, while it's running, I'd like to run "docker build -t imagename:tag " and create another docker image. Do you know how to do this?

@AshokPeddakotla-MSFT Which document specifically should I pick for this? The general one for azure container instances?

[Balakrishna625]

@iocuydi when you create an Azure Container Instance, under the settings section, you can find containers tab, if you click on that tab, there you can find an option called connect . if you click on that you can connect to your ACI, where your source code of application is present, there you can run your Docker commands or any other commands you want. (the working directory which you will enter when you connect to ACI depends on what you give the working directory in Dockerfile )

[iocuydi]

@Balakrishna625 When I try running docker commands inside the instance, I get "failed to dial gRPC: cannot connect to the Docker daemon. Is 'docker daemon' running on the host?: dial tcp: lookup docker on xxxxx no such host"
It seems as though I can't access docker properly from inside the container

[Balakrishna625]

@iocuydi
docker systemctl start docker can you run this command once and try your docker commands again?

[jakaruna-MSFT]

@iocuydi when you create an Azure Container Instance, under the settings section, you can find containers tab, if you click on that tab, there you can find an option called connect . if you click on that you can connect to your ACI, where your source code of application is present, there you can run your Docker commands or any other commands you want. (the working directory which you will enter when you connect to ACI depends on what you give the working directory in Dockerfile )

@iocuydi is not expecting this. He wants to access docker inside ACI.

[jakaruna-MSFT]

@iocuydi I will check and let you know.
If you are running ACI from Pipelines or from any CI, You can consider using other agents like the ones suggested by you microsoft/azure-pipelines-agent#2056

[iocuydi]

@Balakrishna625 I will try using systemctl, thanks. I'm currently using an alpine based docker image so it doesn't have systemctl. Looking at getting the equivalent command on alpine (or switching to ubuntu image)

@jakaruna-MSFT Thank you! Eagerly awaiting your reply.
I'm not using it from pipelines, I would ideally not like to have to use pipelines. ACI works really well for my use case, except for this one problem, so it would be a bit inconvenient to switch the rest of my setup... I like ACI because it is extremely fast when deployed, up and running within seconds, and because it's simple to deploy via cli or python sdk.

If it's impossible to use docker in ACI, could you suggest an alternative that is as similar as possible (i.e. run container from acr, spin up extremely quickly, billed only for uptime)?

[jakaruna-MSFT]

@iocuydi I think we cant access the docker socket from ACI.

Can you try using this docker in docker(dind) image and check if that fulfills your use case https://hub.docker.com/_/docker

[iocuydi]

@Balakrishna625 @jakaruna-MSFT When I try systemctl start docker, I get the error: "Failed to connect to bus: no such file or directory"
When I try using that dind image and running docker, I get "cannot connect to the docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?"

Any other suggestions? Perhaps this is because aci does not run containers with the --priveleged flag?
If not, is there any other way to run this code as quickly as with ACI, and not pay when it isn't running? I thought about trying to run it within an azure function, but these have a 10-15 minute time limit, and building an image could conceivably take longer....

[jakaruna-MSFT]

I tried docker in docker https://hub.docker.com/_/docker in ACI.
That didnt work.
Our next option is to use containers in azure pipelines as shown here microsoft/azure-pipelines-agent#2056

[jakaruna-MSFT]

@iocuydi First option is to use the container snippet as shown here https://docs.microsoft.com/en-us/azure/devops/pipelines/process/container-phases?view=azure-devops&tabs=yaml

you need to add the group option as shown in the github issue on the above comment

or

You can directly build an image by following this document https://docs.microsoft.com/en-us/azure/devops/pipelines/ecosystems/containers/build-image?view=azure-devops

[jakaruna-MSFT]

@iocuydi
I will close this out for now. If you need additional help please let me know and we can reopen and continue.

[iocuydi]

@jakaruna-MSFT Thanks for the replies. I decided to use AKS instead, because other parts of my application don't work in build pipelines. This functionality works fine for AKS, but my only problem is having to delete/recreate the AKS cluster repeatedly when I get a request. Otherwise I seem to get constantly billed on it. The nodepool delete command doesn't seem to work. Opened an issue on it here:
https://github.com/Azure/AKS/issues/1356