<p>I built Docker image on server that can run CI-CD for Jenkins. Because some builds use Docker, I installed Docker inside my image, and in order to allow the inside Docker to run, I had to give it <code>--privilege</code>.</p>
<p>All works good, but I would like to run the docker in docker, on Openshift (or Kubernetes). The problem is with getting the <code>--privilege</code> permissions.</p>
<p>Is running privilege container on Openshift is dangerous, and if so why and how much?</p>

<p>A privileged container can reboot the host, replace the host's kernel, access arbitrary host devices (like the raw disk device), and reconfigure the host's network stack, <a href="https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities" rel="nofollow noreferrer">among other things</a>.  I'd consider it extremely dangerous, and not really any safer than running a process as root on the host.</p>

<p>I'd suggest that using <code>--privileged</code> at all is probably a mistake.  If you really need a process to administer the host, you should run it directly (as root) on the host and not inside an isolation layer that blocks the things it's trying to do.  There are some limited escalated-privilege things that are useful, but if <em>e.g.</em> your container needs to <strong>mlock</strong>(2) you should <code>--cap-add IPC_LOCK</code> for the specific privilege you need, instead of opening up the whole world.</p>

<p>(My understanding is still that trying to run Docker inside Docker is <a href="https://hub.docker.com/_/docker/" rel="nofollow noreferrer">generally considered a mistake</a> and using the host's Docker daemon is preferable.  Of course, this <em>also</em> gives unlimited control over the host...)</p>
