Top all-time · #919
~jpetazzo/
Personal blog · jpetazzo.github.ioprogrammingsystems
~jpetazzo/ is a personal blog at jpetazzo.github.io about programming and systems. Since 2014, 71 different Hacker News readers have linked it 80 times, most often “Using Docker-in-Docker for your CI or testing environment? Think twice”. It is still writing: the last post was on 2025-11-19, and you can follow it by feed.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN readers link Jérôme Petazzoni's posts on Docker internals and container practice, especially "Do not use Docker in Docker", which is cited as the authoritative explanation of its risks.
- Recommended for · 3 comments
- One commenter calls a Docker-in-Docker post a good article and another says it tells it straight from the horse's mouth; one really liked an article on senior a
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Using Docker-in-Docker for your CI or testing environment? Think twice10 people · 10 mentions · first linked 2015-11-23
- Attach a volume to a container while it is running4 people · 4 mentions · first linked 2015-11-24
- One container to rule them all4 people · 4 mentions · first linked 2016-04-07
- Train people well enough4 people · 4 mentions · first linked 2017-04-28
- Using Docker-in-Docker for your CI or testing environment? Think twice4 people · 4 mentions · first linked 2015-09-03
- From DotCloud to Docker (2017)3 people · 3 mentions · first linked 2019-07-28
- Efficient management Python projects dependencies with Docker3 people · 3 mentions · first linked 2016-05-04
- From dotCloud to Docker3 people · 3 mentions · first linked 2017-03-07
- Understanding DNS Resolution on Linux and Kubernetes3 people · 3 mentions · first linked 2024-10-18
- ~jpetazzo/Seven years at Docker2 people · 2 mentions · first linked 2018-02-18
What Hacker News says?
Another au revoir post [0] by Jérôme Petazzoni (also mentioned in shykes's post) a little over a month back. [0] https://jpetazzo.github.io/2018/02/17/seven-years-at-docker/
Comment linking /2018/02/17/seven-years-at-docker/
on “Au Revoir”Submitted Containers, microservices, and service meshes as a story · 273 points
HN discussionI believe Docker was always called Docker, but it grew directly out of the previous generation of the technology used by dotCloud (the company Solomon founded), which was using LXC with AUFS. I think the breakthrough with Docker was bundling the AUFS-based image layer format with a centralized container image sharing registry. This was revolutionary at the time. But another huge element of success was Solomon and ot…
Comment linking /2017/02/24/from-dotcloud-to-docker/
on “Docker is weird”Submitted Is Cloudflare overcharging us for their images service? as a story · 187 points
HN discussionVery interesting, thanks for sharing! I found a good article about it: https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... At the end he describes mounting the socket. The tooling image which has all the dependencies needed to build will also have the docker cli installed, which is what I'm assuming you are doing. I might just use this. Cheers!
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “Docker to rate limit image pulls”Submitted Anti-patterns when building container images as a story · 159 points
HN discussionDocker-in-Docker is a different thing than bind mounting the socket. The former runs a new docker daemon in a container, the latter just talks to the host's socket. Anyway, https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... tells it straight from the horse's mouth. It appears you may not even need privileged containers to pull it off nowadays, but the author still lists several more footguns. Landlock i…
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “Landlock-Ing Linux”Submitted Docker containers should not run an SSH server as a story · 125 points
HN discussionI don't spend a lot of time on those comparison-style charts if I'm honest, but that is good (and valid) feedback for them. I also hadn't heard of it, I discovered sysbox via jpettazo's updated post at https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... , he's an advisor of nestybox the company that develops sysbox. For the CI/CD usecase on AWS, sysbox presented the right balance of trade-offs between so…
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “Real-world stories of how we’ve compromised CI/CD pipelines”Submitted Understanding DNS Resolution on Linux and Kubernetes as a story · 74 points
HN discussionThis is where it comes from and that's probably why it isn't explained in the post: https://github.com/JrCs/docker-letsencrypt-nginx-proxy-compa... It seems like if the author(s) of docker-letsencrypt-nginx-proxy-companion had assumed something like docker compose or kubernetes that neatly handles sharing volumes between containers, they probably wouldn't have made the mistake of giving a docker container access to…
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “Host Your Blog on DigitalOcean with Docker, Nginx and Let’s Encrypt”Submitted Letter to Santa Kube as a story · 56 points
HN discussionFew years ago: https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d...
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “Running VSCode in Docker”Submitted My notes on Amazon's EC2 Container Service, aka Docker on AWS as a story · 51 points
HN discussionDocker has explicit recommendations for enabling control of the daemon from a privileged container, for example to have Jenkins in a container adjacent to the containers it is manipulating. Mentioned in [run command docs]( https://docs.docker.com/engine/reference/commandline/run/#/m... ) and [discussed at length]( https://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-d... ) by senior engineer Jérôme Petazzoni.…
Comment linking /2015/09/03/do-not-use-docker-in-docker-for-ci/
on “IBM Data Science Experience: Whole-Cluster Privilege Escalation Disclosure”Submitted Using Docker-in-Docker for your CI or testing environment? Think twice as a story · 39 points
HN discussionSounds like it might've been this article? https://jpetazzo.github.io/2017/02/24/from-dotcloud-to-docke... ?
Comment linking /2017/02/24/from-dotcloud-to-docker/
on “Docker 19.03: Rootless Mode (Experimental)”Submitted My Notes on Amazon's ECS (EC2 Container Service), aka Docker on AWS as a story · 7 points
HN discussionYou can find some notes on tuning devicemapper here: https://jpetazzo.github.io/assets/2015-03-03-not-so-deep-div... If you've got a new enough kernel though (i.e. 3.18+), you're best off using Overlay for your storage driver. It's fast and doesn't require a lot of tuning.
Comment linking /assets/2015-03-03-not-so-deep-dive-into-docker-storage-drivers.html
on “Goodbye Docker on CentOS, Hello Ubuntu”Submitted From dotCloud to Docker as a story · 5 points
HN discussionIf you're debugging a running container and don't want to even restart it to instrument, you can enter its namespace from the outside and mount more directories with tools. Details: https://jpetazzo.github.io/2015/01/13/docker-mount-dynamic-v...
Comment linking /2015/01/13/docker-mount-dynamic-volumes/
on “Creating an up-to-date Distroless Python Image (2022)”Submitted Using Docker-in-Docker for your CI or testing environment? Think twice as a story · 5 points
HN discussionHmm, thought for sure I'd searched your exactly quote, but I apologize that I missed it. It seems the author of the article in question replied to my comment as well, and it's worth noting because his intent is (more or less) what I got out of reading the post [1]. I don't find it misleading. I think your point of contention may therefore be with the interchange between application and process as synonyms throughout…
Comment linking /2014/06/23/docker-ssh-considered-evil/
on “Understanding the key differences between LXC and Docker”Submitted Train People Well Enough as a story · 4 points
HN discussionWell fwiw software titles are bs. I really liked this article[1] where (among other things) they say: > The primary skill of senior engineers is to train junior engineers. If you’re senior with no junior around, you’re not senior. and > Under that lens, the term “junior” just means “someone who has done less, and/or has less experience with, a specific task or tasks in a specific domain”, by contrast with “senior”.…
Comment linking /2018/08/15/junior-senior-mentor/
on “Ask HN: How do I know if im a slow developer?”Submitted Running Kubernetes without nodes as a story · 4 points
HN discussionSubmitted ~jpetazzo/Seven years at Docker as a story · 4 points
HN discussionSubmitted Train people well enough as a story · 4 points
HN discussionSubmitted Train people well enough as a story · 4 points
HN discussionSubmitted Adventures in GELF as a story · 4 points
HN discussion
