Kaniko with Docker run command

[Andrew Chapman]

Hello all,

I have a question related to the command "docker run" and its use with Kaniko to build/push an image from an input Dockerfile.

My understanding is that "docker run" cannot be executed without a docker daemon running in the background but the whole reason I wanted to use Kaniko is because it supposedly does not require this.

In fact, when I run:

docker run

 -v $HOME/.config/gcloud:/root/.config/gcloud 

-v config.json:$HOME/.docker/config.json:ro 

-v $1/target:/workspace

 gcr.io/kaniko-project/executor:latest 

--dockerfile $1/docker/Dockerfile 

--destination $PUSH_REPO 

--context dir:///workspace/

I get the following error:

/usr/bin/docker-current: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.

But the Kaniko tool should not need a docker daemon so I am kind of confused. Can someone help me to understand what I am missing?

[Oliver Diamond]

Kaniko is ONLY for building images. It can't run them at all

[Oliver Diamond]

Kaniko is often used as a docker image so that people can use it to build images in Kubernetes without using the same docker daemon that is being used to run the images.

In order to build a docker image without the docker daemon entirely (or another container solution), you'd need to use the kaniko executable. Which will be complex.

In reality Kaniko is not for escaping the docker daemon entirely, but for not using the same daemon to build and run images. This solves the problem that Kubernetes has when attempting to run a ci pipeline.

[Andrew Chapman]

Thanks very much for the information Oliver.

Do you know of any material that goes over using the kaniko executable directly to avoid using the docker daemon?

[Oliver Diamond]

I could be wrong (i'm not on the kaniko team) but I don't think Kaniko is the right tool for you.

The only reason not to use the Docker Daemon that i know of - is in a Kubernetes Cluster. Otherwise the Docker Daemon is much better than kaniko - and much easier to use.

You can try here: https://github.com/GoogleContainerTools/kaniko
Or you can scroll down on that page to the Comparison with Other Tools section - i think perhaps a tool like orca-build might be more suited to you.

[Andrew Chapman]

What seems strange to me and kind of misleading honestly is that in one section of the Kaniko documentation it states:

Then, further down it says:

If there is not a way to avoid the docker daemon for all use cases I think this should be called out somewhere....

[Oliver Diamond]

I can see your confusion.

Although it does say a number of times that it's running inside a container. There are ways of running containers without docker so I'm sure that technically you could avoid it.

I think your misunderstanding must arise from a pretty bizarre use case. The only time I wouldn't want to use docker is inside docker. That's the problem that Kaniko solves.