Enable Docker-in-Docker (or Sysbox/Podman) inside Coder workspaces
At a glance
Official Coder docs compare four ways to run Docker builds and tests inside container workspaces: Sysbox runtime, Envbox, rootless Podman, or a privileged docker:dind sidecar. This workflow is listed under sponsor, devtools, docker, templates, platform.
- Agents / tools
- Coder, Docker, Sysbox, Podman, Terraform
Building a tool for these workflows? See weekly rates.
What they did
Pick an isolation model for Docker-in-workspace: install Sysbox on the host/nodes and set runtime = "sysbox-runc" (Docker templates) or runtime_class_name = "sysbox-runc" (Kubernetes), start dockerd in the agent startup_script; or use Envbox (privileged outer image that nests an unprivileged Sysbox workspace, no node runtime install); or rootless Podman with smarter-device-manager FUSE + codercom/example-podman image (no custom RuntimeClass); or add a privileged docker:dind sidecar and point DOCKER_HOST at it. Publish a new template version, create a test workspace, and verify with docker build/ps (or podman).
Worth knowing
Privileged dind sidecars are explicitly insecure—workspaces can break out to host root. Envbox still needs a privileged outer container though the inner workspace is locked down, and first startup is slower while images cache. Rootless Podman needs FUSE device plugin and user namespaces; Bottlerocket defaults max_user_namespaces to 0, and EKS Auto Mode cannot raise it via userData—use a separate managed node group instead. Sysbox/Envbox need compatible kernels per Sysbox's matrix.
