Difference between Docker-in-Docker (dind) vs mounting /var/run/docker.sock in CI/CD pipelines?

[6mhkgfhb8j-blip]

Hi everyone 👋,

I am setting up a CI/CD pipeline (using GitHub Actions / GitLab CI) to build Docker images inside a containerized runner.

I see two main approaches using the official docker image:

1. Running Docker-in-Docker using the docker:dind tag with --privileged.
2. Mounting the host's Docker socket into the container using -v /var/run/docker.sock:/var/run/docker.sock.

Could someone clarify:

• What are the main practical differences between these two approaches?
• Which option is recommended for CI/CD builds?
• What are the security risks associated with mounting docker.sock vs running dind?

Thanks in advance!

[GafelSon]

The key difference is where the Docker daemon runs:

• docker.sock → your CI container talks directly to the host Docker daemon. Simple and fast, but effectively gives the container Docker-level control over the host.
• docker:dind → runs a separate Docker daemon inside a container. Better isolation, but usually requires --privileged and adds complexity.

For trusted self-hosted CI, docker.sock is often the pragmatic choice.

For untrusted workloads, neither is automatically safe — dind --privileged also has serious security implications. If isolation matters, consider rootless BuildKit/Buildah instead.