devcontainers / devcontainers/features

[docker-in-docker] Not working with Docker Desktop and Enhanced Container Isolation

Open
#1,319 0 comments 2 reactions 1 assignee Claimed by @v-Mathiyarasy View on GitHub
Dominant language
Shell
Stars
1.5k
Forks
621
Avg merge
2d 11h
Merged PRs (30d)
4

Description

The feature [docker-in-docker](https://github.com/devcontainers/features/tree/main/src/docker-in-docker) fails to start the docker daemon with the error message

```txt
mount: /sys/kernel/security: permission denied.
dmesg(1) may have more information after failed mount system call.
Could not mount /sys/kernel/security.
AppArmor detection and --privileged mode might break.
```
when using a devcontainer with the Docker Desktop Hyper-V backend and having [Enhanced Container Isolation](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/) enabled.

The container is started using --privileged however there are still some restrictions:

[ECI](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/#:~:text=Containers%20become%20harder,inside%20the%20container.)
> Containers become harder to breach. For example, sensitive system calls are vetted and portions of /proc and /sys are emulated inside the container.

This [part of the code](https://github.com/devcontainers/features/blob/2eb4b5ce7ad97b3ea82a84606e69139a867f078d/src/docker-in-docker/install.sh#L517) that checks for AppArmor stops the start, even though it would otherwise work perfectly fine.
```sh
if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
mount -t securityfs none /sys/kernel/security || {
echo >&2 'Could not mount /sys/kernel/security.'
echo >&2 'AppArmor detection and --privileged mode might break.'
}
fi
```

When building the container with [ECI](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/) disabled and then running the built container with it enabled, everything works fine.

I would propose to either add a feature flag to disable the check or remove it altogether, however I am not too sure how many run into issues with running AppArmor inside a devcontainer base container.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.