{"id":26026463,"url":"https://github.com/pusnow/dinv","last_synced_at":"2026-04-27T05:01:30.728Z","repository":{"id":85305685,"uuid":"427243562","full_name":"Pusnow/dinv","owner":"Pusnow","description":"Docker in VM","archived":false,"fork":false,"pushed_at":"2022-02-22T01:36:05.000Z","size":65,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-17T15:11:31.674Z","etag":null,"topics":["docker","microvm","qemu"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Pusnow.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-12T05:30:48.000Z","updated_at":"2024-08-16T09:53:46.000Z","dependencies_parsed_at":"2023-03-13T04:49:22.818Z","dependency_job_id":null,"html_url":"https://github.com/Pusnow/dinv","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Pusnow/dinv","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pusnow%2Fdinv","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pusnow%2Fdinv/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pusnow%2Fdinv/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pusnow%2Fdinv/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Pusnow","download_url":"https://codeload.github.com/Pusnow/dinv/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Pusnow%2Fdinv/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32323215,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","microvm","qemu"],"created_at":"2025-03-06T14:57:29.148Z","updated_at":"2026-04-27T05:01:30.689Z","avatar_url":"https://github.com/Pusnow.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dinv (Docker in VM)\n\n* [Korean version](https://www.pusnow.com/note/dinv/)\n\nRun Docker containers in microVM in a Docker container\n\n## Why dinv?\n\nTo build a dockerized CI pipeline, you may have to run docker inside a docker container (e.g., [building docker images in a Jenkins container](https://www.jenkins.io/doc/book/installing/docker/)).\nHowever, due to the Docker container's permission, privileges, etc., spawning containers inside a container is a little bit tricky and sacrifices security.\n[DinD (Docker-in-Docker)](https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/), for example, requires `--privileged` flag, and [using it should be avoided for security](https://docs.docker.com/engine/reference/commandline/run/#full-container-capabilities---privileged).\nDooD (Docker-out-of-Docker), on the other hand, shares the host-side `dockerd` daemon by binding the host's docker control socket (`/var/run/docker.sock`).\nThis method does not require `--privileged` flag but allows direct access to the host-side `dockerd`, giving full view and permission of the daemon.\n[Sysbox](https://github.com/nestybox/sysbox) is a special container runtime for this purpose; however, it requires host-side setup.\n\nWe build DinV (Docker-in-VM), which allows spawning containers in a docker container without `--privileged`, `dockerd` sharing, and a special runtime.\nDinV uses [QEMU's microVM](https://qemu.readthedocs.io/en/latest/system/i386/microvm.html) to run a lightweight virtual machine with a separate Linux image ([Alpine Linux](https://www.alpinelinux.org)) and `dockerd` daemon.\nAlso, it supports port binding (via `hostfwd` of [SLIRP](https://wiki.qemu.org/Documentation/Networking#User_Networking_.28SLIRP.29)) and file system sharing (via [virtio-9p](https://wiki.qemu.org/Documentation/9psetup)).\n\n|                            | DooD                                                 | DinD                                     | Sysbox                          | DinV                                                                                                                                                              |\n|----------------------------|------------------------------------------------------|------------------------------------------|---------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Requirement                | Bind mounting of `/var/run/docker.sock`              | `--privileged` flag                      | Special runtime (`sysbox-runc`) | KVM device option (`--device /dev/kvm`)                                                                                                                           |\n| Require special runtime    | No                                                   | No                                       | Yes                             | No                                                                                                                                                                |\n| `dockerd` separation       | Shared with host (no separation)                     | Separated                                | Separated                       | Separated                                                                                                                                                         |\n| Security                   | Container can create/delete/modify host's containers | Weak isolation (require privileged mode) | ?                               | Strong isolation (VM isolation + unprivileged)                                                                                                                    |\n| Compute/memory performance | Native                                               | Native                                   | ?                               | Near-native (VT-x accelerated)                                                                                                                                    |\n| Networking performance     | Native                                               | Native                                   | ?                               | Poor (depends on [SLIRP](https://wiki.qemu.org/Documentation/Networking#User_Networking_.28SLIRP.29))                                                             |\n| I/O performance            | Native                                               | Native                                   | ?                               | [Volumes](https://docs.docker.com/storage/volumes/): Near-native (`virtio-blk`) \u003cbr\u003e Bind mounts: Poor ([virtio-9p](https://wiki.qemu.org/Documentation/9psetup)) |\n\n## Usage\n\n### Basic Usage\n\n```bash\n$ docker run -d --rm --name dinv --device /dev/kvm pusnow/dinv:latest\n$ # wait few seconds\n$ docker exec -it dinv docker run -it --rm debian\nUnable to find image 'debian:latest' locally\nlatest: Pulling from library/debian\n0c6b8ff8c37e: Pull complete \nDigest: sha256:fb45fd4e25abe55a656ca69a7bef70e62099b8bb42a279a5e0ea4ae1ab410e0d\nStatus: Downloaded newer image for debian:latest\nroot@1ee213376f22:/# \n```\n\nOr, you can use Docker management port.\n\n```bash\n$ docker run -d --rm --name dinv --device /dev/kvm -p127.0.0.1:2375:2375 pusnow/dinv:latest\n$ # wait few seconds\n$ docker -H tcp://127.0.0.1:2375 ps\nCONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES\n$ DOCKER_HOST=\"tcp://127.0.0.1:2375\" docker ps\nCONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES\n```\n\n### Port Forwarding\n\n* Note: you have to specifiy forwared ports via `DINV_TCP_PORTS` environment variable. Semicolon-separated list is allowed.\n* Note 2: DinV uses a bridged network (172.19.0.0/16) inside VM. Make sure your host docker network does not use the range (Docker's default network range is 172.17.0.0/16).\n\n```bash\n$ docker run -d --rm -p8080:8080 -e DINV_TCP_PORTS=8080 --name dinv --device /dev/kvm pusnow/dinv:latest\n$ # wait few seconds\n$ docker exec -it dinv docker run -d -p8080:80 --rm nginx\n$ curl http://127.0.0.1:8080\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n\u003ctitle\u003eWelcome to nginx!\u003c/title\u003e\n...\n```\n\n### Bind Mount\n\n* Note: you have to specifiy bind mounts via `DINV_MOUNTS` environment variable. Semicolon-separated list is allowed.\n* Note: we've found virtio-9p is terribly slow. Please, avoid I/O heavy workloads on it.\n\n```bash\n$ mkdir -p data \u0026\u0026 echo \"Hello world\" \u003e data/hello.txt\n$ cat data/hello.txt\nHello world\n$ docker run -d --rm -v $PWD/data:/data -e DINV_MOUNTS=/data --name dinv --device /dev/kvm pusnow/dinv:latest\n$ # wait few seconds\n$ docker exec -it dinv docker run -it -v/data:/data debian cat /data/hello.txt\nUnable to find image 'debian:latest' locally\nlatest: Pulling from library/debian\n0c6b8ff8c37e: Pull complete \nDigest: sha256:fb45fd4e25abe55a656ca69a7bef70e62099b8bb42a279a5e0ea4ae1ab410e0d\nStatus: Downloaded newer image for debian:latest\nHello world\n```\n\n### Environment Variables\n\n| Name                    | Description                                                                                   |\n|-------------------------|-----------------------------------------------------------------------------------------------|\n| `DINV_CPUS`             | Number of CPUS for VM (default: 1)                                                            |\n| `DINV_MEMORY`           | Amount of memory for VM (default: 512M)                                                       |\n| `DINV_TCP_PORTS`        | TCP port numbers for forwarding. Semicolon-separated list (default: none)                     |\n| `DINV_UDP_PORTS`        | UDP port numbers for forwarding. Semicolon-separated list (default: none)                     |\n| `DINV_MOUNTS`           | Paths for bind mounts. Semicolon-separated list (default: none)                               |\n| `DINV_DOCKER_SIZE`      | Initial size of Docker VM disk for `/var/lib/docker` (default: 64G)                           |\n| `DINV_VOLUME_PATH`      | If specified, DinV mount an additional VM disk image on the path (default: none)              |\n| `DINV_VOLUME_SIZE`      | Initial size of the `DINV_VOLUME_PATH` VM disk image                                          |\n| `DINV_VOLUME_UID`       | UID of the `DINV_VOLUME_PATH`                                                                 |\n| `DINV_VOLUME_GID`       | GID of the `DINV_VOLUME_PATH`                                                                 |\n| `DINV_DOCKER_SOCK_UID`  | UID of the `/var/run/docker.sock`                                                             |\n| `DINV_DOCKER_SOCK_GID`  | GID of the `/var/run/docker.sock`                                                             |\n| `DINV_SHUTDOWN_TIMEOUT` | DinV `dockerd`'s shutdown time out value (default: 5)                                         |\n| `DINV_MACHINE`          | DinV machine type. Use `microvm` for a microVM and `q35` for a normal VM (default: `microvm`) |\n\n\n### Volumes\n\n| Path      | Description                                                            |\n|-----------|------------------------------------------------------------------------|\n| `/docker` | VM disk image store for Docker (`/var/lib/docker`)                     |\n| `/volume` | VM disk image store for an additioanl DinV volume (`DINV_VOLUME_PATH`) |\n\n### Ports\n\n| Port Number | Description         |\n|-------------|---------------------|\n| `2375`      | Docker control port |\n\n## TODO\n\n* virtio-fs (current QEMU microVM does not support it)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpusnow%2Fdinv","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpusnow%2Fdinv","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpusnow%2Fdinv/lists"}