[Python] Why do we need to mount config.json for sharing credential in Docker in Docker using...

A follow up question for When a container mounts host's Docker socket, can it also have access to host's credentials?

When we mount Docker’s socket into our container to enable Docker‑in‑Docker, why must we also mount the host’s config.json in order to authenticate and pull private images?

In the host machine, I have already done the authentication using docker login.

Since mounting /var/run/docker.sock makes every Docker command inside the container execute on the host, I assumed the container would automatically inherit the host’s authentication. Yet in practice, I still need to mount ~/.docker/config.json.

Example for better explanation

I have a container execute_simulation. My execute_simulation container runs this Python code:

import docker

client = docker.from_env()

container = None

container = client.containers.run(
image=<private image>,
environment=environment_vars,
volumes=volumes,
detach=True,
auto_remove=False,
)


Because <private-image> lives in a private registry, it requires prior authentication. Normally on the host I simply do:

docker login my.registry.com
docker run my.registry.com/private-image:latest


but when I invoke .run() from inside execute_simulation, I must mount both the Docker socket and the host’s config.json in my docker-compose.yml:

x-execute-simulator: &execute-simulator
image: execute-simulator:<tag>
restart: always
environment:
TZ: ${TZ:?tz unset}
<<: *common-env
volumes:
- ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock
- ~/.docker/config.json:/root/.docker/config.json:ro



Mounting config.json copies the host’s authentication tokens into /root/.docker/config.json inside the container.

But if every Docker command still runs on the host in docker-in-docker mode, why can’t the container simply use the host’s login credentials without explicitly mounting that file?

Continue reading...