如何在Docker构建流程中启动Docker容器？

问题背景 #

需要在Docker容器内构建打包项目，但项目构建流程必须启动Docker来构建其他镜像，无法跳过该步骤。已在构建过程中完成Docker安装，但无法启动容器（尝试过多个基础镜像）。

原Dockerfile片段 #

FROM maven:3.9.9-eclipse-temurin-11 as builder

RUN apt-get update --yes --quiet && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    apt-transport-https ca-certificates curl software-properties-common gnupg
RUN install -m 0755 -d /etc/apt/keyrings
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
RUN chmod a+r /etc/apt/keyrings/docker.asc
RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
RUN apt update --yes --quiet
RUN apt-cache policy docker-ce
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

USER root
RUN usermod -aG docker root
# Fixing the bug: https://forums.docker.com/t/etc-init-d-docker-62-ulimit-error-setting-limit-invalid-argument-problem/139424
RUN sed -i 's/ulimit -Hn/ulimit -n/g' /etc/init.d/docker

RUN service docker start

RUN docker run hello-world

报错信息 #

执行docker run hello-world时抛出：

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.
See 'docker run --help'.

进入容器排查，service docker start启动后很快失败，关键日志：

time="2024-10-12T15:21:02.998983540Z" level=info msg="containerd successfully booted in 0.042406s"
time="2024-10-12T15:21:04.001703179Z" level=error msg="failed to mount overlay: operation not permitted" storage-driver=overlay2
time="2024-10-12T15:21:04.001745444Z" level=error msg="exec: \"fuse-overlayfs\": executable file not found in $PATH" storage-driver=fuse-overlayfs
time="2024-10-12T15:21:04.001816599Z" level=warning msg="Unable to setup quota: operation not permitted\n"
time="2024-10-12T15:21:04.016718098Z" level=info msg="unable to detect if iptables supports xlock: 'iptables --wait -L -n': `iptables v1.8.10 (nf_tables): Could not fetch rule set generation id: Permission denied (you must be root)`" error="exit status 4"
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: failed to create NAT chain DOCKER: iptables failed: iptables -t nat -N DOCKER: iptables v1.8.10 (nf_tables): Could not fetch rule set generation id: Permission denied (you must be root)
 (exit status 4)

问题根源 #

日志中的operation not permitted和Permission denied是核心问题：默认Docker容器没有足够特权启动Docker daemon——Docker daemon需要创建overlay挂载、修改iptables网络规则等宿主机级操作，普通容器无法获取这些权限。

解决方案 #

方案1：挂载宿主Docker套接字（推荐，资源高效） #

直接复用宿主机的Docker daemon，无需在容器内启动新daemon，这是最常用且高效的方式。

修改后的Dockerfile

FROM maven:3.9.9-eclipse-temurin-11 as builder

# 仅安装Docker CLI工具，无需daemon组件
RUN apt-get update --yes --quiet && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    apt-transport-https ca-certificates curl software-properties-common gnupg
RUN install -m 0755 -d /etc/apt/keyrings
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
RUN chmod a+r /etc/apt/keyrings/docker.asc
RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
RUN apt update --yes --quiet
# 只安装CLI和compose插件，跳过daemon相关包
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin

# 构建时挂载宿主机的Docker套接字，直接调用宿主机的Docker daemon
RUN --mount=type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
    docker run hello-world

构建命令

无需额外特权，直接执行：

docker build .

注意事项

• 宿主机必须已安装并运行Docker
• 容器内Docker CLI版本建议与宿主机Docker版本兼容，避免兼容性问题
• 容器内的Docker操作实际在宿主机执行，所有镜像、容器会保存在宿主机上

方案2：使用Docker-in-Docker（DinD） #

如果需要完全隔离的Docker环境（比如构建流程不能影响宿主机Docker），可使用官方DinD镜像或在现有镜像中配置，需给容器赋予特权。

修改后的Dockerfile

FROM maven:3.9.9-eclipse-temurin-11 as builder

# 完整安装Docker daemon和CLI，添加fuse-overlayfs解决存储驱动问题
RUN apt-get update --yes --quiet && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    apt-transport-https ca-certificates curl software-properties-common gnupg fuse-overlayfs
RUN install -m 0755 -d /etc/apt/keyrings
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
RUN chmod a+r /etc/apt/keyrings/docker.asc
RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
RUN apt update --yes --quiet
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 修复ulimit问题
RUN sed -i 's/ulimit -Hn/ulimit -n/g' /etc/init.d/docker

# 启动dockerd并等待就绪，然后执行测试命令
RUN dockerd & sleep 10 && docker run hello-world

构建命令

必须添加--privileged参数赋予容器特权：

docker build --privileged .

注意事项

• --privileged会给容器几乎与宿主机相同的权限，存在安全风险，仅限必要场景使用
• DinD会占用额外系统资源，镜像构建速度比方案1慢

方案3：添加特定容器能力（不推荐） #

尝试给容器添加特定Linux能力满足Docker daemon需求，但配置复杂，仍可能遇到权限问题，不推荐生产环境使用。

构建时添加能力：

docker build --cap-add SYS_ADMIN --cap-add NET_ADMIN .

内容的提问来源于stack exchange，提问作者Oleksandr