docker
Strange Host-Mount Behavior with Mounted Docker Socket
Description
When running nested Docker containers with volume mounts, bind-mounts from the host do not work when the Docker socket is mounted from /var/run/docker.sock. However, the issue does not occur when mounting the Docker socket with a different name, such as through a symbolic link or an socat listener.
This behavior was reported to us by a client after updating to 4.28. I was able to reproduce it with a fresh 4.28.0 installation and Ubuntu WSL
Reproduce
- A directory to mount:
mand@towelie:~$ ls -l /home/mand/stuff
total 40
-rw-r--r-- 1 mand mand 2186 Mar 19 16:38 Makefile
-rw-r--r-- 1 mand mand 127 Mar 19 16:38 README.md
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 boot
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 fs
drwxr-xr-x 5 mand mand 4096 Mar 19 16:38 include
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 init
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 kernel
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 lib
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 mm
drwxr-xr-x 2 mand mand 4096 Mar 19 16:38 tools
- Run a nested Docker container with the original Docker socket mounted, and bind-mount the prepared directory:
mand@towelie:~$ docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock docker sh -c "DOCKER_HOST=unix:///var/run/docker.sock docker run -it --rm -v /home/mand/stuff:/stuff busybox ls -l /stuff"
total 0
No files.
- Create a link to the socket and use that for the mount target:
mand@towelie:~$ sudo bash -c "pushd /var/run; ln docker.sock ducker.sock; ls -l d*cker.sock"
/var/run /home/mand
srwxrwxrwx 2 root docker 0 Mar 19 13:26 docker.sock
srwxrwxrwx 2 root docker 0 Mar 19 13:26 ducker.sock
mand@towelie:~$ docker run --rm -it -v /var/run/ducker.sock:/var/run/docker.sock docker sh -c "DOCKER_HOST=unix:///var/run/docker.sock docker run -it --rm -v /home/mand/stuff:/stuff busybox ls -l /stuff"
total 40
Success.
Expected behavior
The contents of the mounted volume should be correctly listed by the busybox container in both cases, regardless of whether the original Docker socket or a symbolic link to it is used.
docker version
Client:
Cloud integration: v1.0.35+desktop.11
Version: 25.0.3
API version: 1.44
Go version: go1.21.6
Git commit: 4debf41
Built: Tue Feb 6 21:13:00 2024
OS/Arch: linux/amd64
Context: default
Server: Docker Desktop
Engine:
Version: 25.0.3
API version: 1.44 (minimum version 1.24)
Go version: go1.21.6
Git commit: f417435
Built: Tue Feb 6 21:14:25 2024
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.28
GitCommit: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
runc:
Version: 1.1.12
GitCommit: v1.1.12-0-g51d5e94
docker-init:
Version: 0.19.0
GitCommit: de40ad0
docker info
Client:
Version: 25.0.3
Context: default
Debug Mode: false
Plugins:
buildx: Docker Buildx (Docker Inc.)
Version: v0.12.1-desktop.4
Path: /usr/local/lib/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.24.6-desktop.1
Path: /usr/local/lib/docker/cli-plugins/docker-compose
debug: Get a shell into any image or container. (Docker Inc.)
Version: 0.0.24
Path: /usr/local/lib/docker/cli-plugins/docker-debug
dev: Docker Dev Environments (Docker Inc.)
Version: v0.1.0
Path: /usr/local/lib/docker/cli-plugins/docker-dev
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.22
Path: /usr/local/lib/docker/cli-plugins/docker-extension
feedback: Provide feedback, right in your terminal! (Docker Inc.)
Version: v1.0.4
Path: /usr/local/lib/docker/cli-plugins/docker-feedback
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.0.1
Path: /usr/local/lib/docker/cli-plugins/docker-init
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /usr/local/lib/docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.5.0
Path: /usr/local/lib/docker/cli-plugins/docker-scout
Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 7
Server Version: 25.0.3
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
runc version: v1.1.12-0-g51d5e94
init version: de40ad0
Security Options:
seccomp
Profile: unconfined
Kernel Version: 5.15.146.1-microsoft-standard-WSL2
Operating System: Docker Desktop
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 7.547GiB
Name: docker-desktop
ID: 5f6668f4-3d06-41fa-afd6-2b61660605e9
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
127.0.0.0/8
Live Restore Enabled: false
Diagnostics ID
FF858BC0-464D-4B99-8246-B373229476E4/20240319172045
Additional Info
No response
had the same problem after windows 11 update KB5035853. Had to abandon docker desktop for docker-ce inside wsl2.
Had the same problem locally. Downgrading to 4.27.2 causes the correct behaviour to come back. In 4.28.0, creating the symlink to /var/run/docker.sock worked for me as a workaround, as listed in the description above, though for sure I would prefer if this was not necessary.
I'm also affected buy this issue. In the exact same situation. docker-in-docker devcontainer on WSL2. Host volumes no longer mount correctly on Docker Desktop 4.28.0 or 4.29.0. The mount does appear to succeed but only directories are present. All files are missing. Rolling Docker Desktop back to 4.27.2 resolves the issue.
Save problem with ver 4.28.0 or 4.29.0 Host windows 11 23h2 22631.3447 wsl2 Debian GNU/Linux 12 (bookworm)
Error response from daemon: invalid mount config for type "bind" ...
4.27.2 resolves the issue.
