DinD vs DooD: How the Container Talks to Docker

DinD vs DooD: How the Container Talks to Docker An architecture diagram generated by Archify. Browser · VS Code in the browser · Architecture component Browser VS Code in the browser VS Code Container · code-server · Option A · Docker-in-Docker · isolated VS Code Container code-server isolated Inner Docker Daemon · dockerd in-container · Option A · Docker-in-Docker Inner Docker Daemon dockerd in-container Private Image Store · duplicated images · Option A · Docker-in-Docker Private Image Store duplicated images VS Code Container · code-server · Option B · Docker-outside-of-Docker · socket mounted VS Code Container code-server socket mounted Host Docker Daemon · dockerd on host · Option B · Docker-outside-of-Docker Host Docker Daemon dockerd on host Shared Image Store · one store, host + IDE · Option B · Docker-outside-of-Docker Shared Image Store one store, host + IDE HTTPS HTTPS own daemon private pulls docker.sock mount shared images Option A · Docker-in-Docker Option B · Docker-outside-of-Docker Legend Frontend Backend Database Cloud

Docker-in-Docker

  • • A second full Docker daemon runs inside the VS Code container
  • • Its own private, isolated Docker world
  • • Images are duplicated — no visibility into host images

Docker-outside-of-Docker

  • • The host Docker socket is mounted into the container
  • • Commands go straight to the host dockerd
  • • One Docker shared by host and IDE, full image visibility

Security trade-off

  • • The mounted socket grants full control of the host Docker daemon
  • • A compromised IDE container can control the whole host
  • • Restrict or isolate DooD setups deliberately