devcontainers / devcontainers/features
[docker-in-docker] Not working with Docker Desktop and Enhanced Container Isolation
- Dominant language
- Shell
- Stars
- 1.5k
- Forks
- 621
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 4
Description
The feature [docker-in-docker](https://github.com/devcontainers/features/tree/main/src/docker-in-docker) fails to start the docker daemon with the error message
```txt
mount: /sys/kernel/security: permission denied.
dmesg(1) may have more information after failed mount system call.
Could not mount /sys/kernel/security.
AppArmor detection and --privileged mode might break.
```
when using a devcontainer with the Docker Desktop Hyper-V backend and having [Enhanced Container Isolation](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/) enabled.
The container is started using --privileged however there are still some restrictions:
[ECI](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/#:~:text=Containers%20become%20harder,inside%20the%20container.)
> Containers become harder to breach. For example, sensitive system calls are vetted and portions of /proc and /sys are emulated inside the container.
This [part of the code](https://github.com/devcontainers/features/blob/2eb4b5ce7ad97b3ea82a84606e69139a867f078d/src/docker-in-docker/install.sh#L517) that checks for AppArmor stops the start, even though it would otherwise work perfectly fine.
```sh
if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
mount -t securityfs none /sys/kernel/security || {
echo >&2 'Could not mount /sys/kernel/security.'
echo >&2 'AppArmor detection and --privileged mode might break.'
}
fi
```
When building the container with [ECI](https://docs.docker.com/security/for-admins/hardened-desktop/enhanced-container-isolation/) disabled and then running the built container with it enabled, everything works fine.
I would propose to either add a feature flag to disable the check or remove it altogether, however I am not too sure how many run into issues with running AppArmor inside a devcontainer base container.
Contributor guide
Assessment
This issue has not been assessed yet.