docker dood

Advanced: Docker outside Docker (DooD)

Sometimes the agent needs Docker inside its environment — to run docker build, spin up a test database, or run integration tests in containers. Forge Fleet supports this, but not the way people often assume.

We do not do Docker-in-Docker

Docker-in-Docker (DinD) runs a second, nested Docker daemon inside the container. It's heavy, needs privileged mode, and is fiddly to get right. Forge Fleet does not use it.

We do Docker outside Docker (DooD)

Docker-outside-of-Docker (DooD) instead lets the agent's container talk to the host's Docker daemon — the same one ffleet itself uses. There's no nested daemon: the Docker CLI inside the environment is just a client pointed at the host socket. Containers the agent starts are therefore siblings of the agent's container (both children of the host daemon), not children nested inside it.

flowchart TD
    subgraph host[Host]
        D[Host Docker daemon]
        D --> AC[Agent container]
        D --> SC[Sibling container the agent started]
        AC -. docker CLI over host socket .-> D
    end

Loading

Enabling it

Set the host-bind option, which binds the host Docker socket into the agent container:

• Config: docker_host_bind = true in ffleet.toml.
• Or per run: ffleet up SLUG --docker-host-bind ….

With that on, docker … commands run by the agent are executed by the host daemon.

Things to keep in mind

• Shared daemon = shared blast radius. The agent can see and affect the host's other containers, images, and volumes. Only enable DooD for environments you trust to drive Docker.
• Paths are host paths. Because the real daemon is the host's, any bind mount the agent's docker run requests is resolved on the host filesystem, not inside the agent container. Mount host paths the agent can actually reach — see container configuration and extra_mounts.
• Sibling lifetime. Containers the agent starts are independent siblings; they don't get cleaned up automatically when the environment is stopped or removed. The agent (or you) should tear them down.

Related

• Container configuration — mounts, hosts, image.
• docker_host_bind, extra_mounts, extra_hosts in the config reference.