Run docker inside of docker on AWS Fargate

Question

I created a task definition on Amazon ECS and want to run in with Fargate. I set up my task, network mode is awsvpc. I created a new container with a docker image (simple "Hello world" project) on Amazon ECR. Run the task - everything works fine. Now I need to run a docker container from hub.docker.com as a part of the task

Dockerfile

FROM ubuntu

RUN apt-get update && apt-install ...
ADD script.sh /script.sh
RUN chmod +x /script.sh
ENTRYPOINT ["/script.sh"]

script.sh

#!/bin/bash

...prepare data
docker run -rm some_container_from_docker_hub
...continue process data

Initially, I got "command not found" error. OK, I installed docker into my image. Now I've got "Cannot connect to the Docker daemon". My question: is there any way to run a docker container inside of another docker container on Amazon Fargate?

Answer 1

You can't run a container from another container using Fargate. Running a container from another one, like in your case, would mean that you could have access to the docker daemon. Accessing the docker daemon means root access to the host machine. This breaks the docker container isolation and is unsafe.

Depending on your usage, I suggest you use an EC2 instance, use CodeBuild or build an operator that is able to talk with the api to span containers.

[Edit]: It seems that there is an open issue on this topic [ECS,Fargate]: Support for building Docker containers #95