---
title: Run Docker-in-Docker
description: Run Docker commands inside a sandbox container.
image: https://edgetunnel-b2h.pages.dev/dev-products-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/sandbox/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Run Docker-in-Docker

This guide shows you how to run Docker inside a Sandbox, enabling you to build and run container images from within a secure sandbox.

## When to use Docker-in-Docker

Use Docker-in-Docker when you need to:

* **Develop containerized applications** \- Run `docker build` to create images from Dockerfiles
* **Run Docker as part of CI/CD** \- Respond to code changes and build and push images using Cloudflare Containers
* **Run arbitrary container images** \- Start containers from an end-user provided image

## Create a Docker-enabled image

Cloudflare Containers run without root privileges, so you must use the rootless Docker image. Create a custom Dockerfile that combines the sandbox binary with Docker:

**Dockerfile**

```dockerfile
FROM docker:dind-rootless
USER root


# Use the musl build so it runs on Alpine-based docker:dind-rootless
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /container-server/sandbox /sandbox
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /usr/lib/libstdc++.so.6 /usr/lib/libstdc++.so.6
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /usr/lib/libgcc_s.so.1 /usr/lib/libgcc_s.so.1
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /bin/bash /bin/bash
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /usr/lib/libreadline.so.8 /usr/lib/libreadline.so.8
COPY --from=docker.io/cloudflare/sandbox:0.7.4-musl /usr/lib/libreadline.so.8.2 /usr/lib/libreadline.so.8.2


# Create startup script that starts dockerd with
# iptables disabled, waits for readiness, then keeps running
RUN printf '#!/bin/sh\n\
  set -eu\n\
  dockerd-entrypoint.sh dockerd --iptables=false --ip6tables=false &\n\
  until docker version >/dev/null 2>&1; do sleep 0.2; done\n\
  echo "Docker is ready"\n\
  wait\n' > /home/rootless/boot-docker-for-dind.sh && chmod +x /home/rootless/boot-docker-for-dind.sh


ENTRYPOINT ["/sandbox"]
CMD ["/home/rootless/boot-docker-for-dind.sh"]
```

Working with disabled iptables

Cloudflare Containers do not support iptables manipulation. The `--iptables=false` and `--ip6tables=false` flags prevent Docker from attempting to configure network rules, which would otherwise fail.

To send or receive traffic from a container running within Docker-in-Docker, use the `--network=host` flag when running Docker commands.

This allows you to connect to the container, but it means each inner container has access to your outer container's network stack. Ensure you understand the security implications of this setup before proceeding.

## Use Docker in your sandbox

Once deployed, you can run Docker commands through the sandbox:

* [  JavaScript ](#tab-panel-11191)
* [  TypeScript ](#tab-panel-11192)

**JavaScript**

```js
import { getSandbox } from "@cloudflare/sandbox";


const sandbox = getSandbox(env.Sandbox, "docker-sandbox");


// Build an image
await sandbox.writeFile(
  "/workspace/Dockerfile",
  `
FROM alpine:latest
RUN apk add --no-cache curl
CMD ["echo", "Hello from Docker!"]
`,
);


const build = await sandbox.exec(
  "docker build --network=host -t my-image /workspace",
);
if (!build.success) {
  console.error("Build failed:", build.stderr);
}


// Run a container
const run = await sandbox.exec("docker run --network=host --rm my-image");
console.log(run.stdout); // "Hello from Docker!"
```

**TypeScript**

```ts
import { getSandbox } from "@cloudflare/sandbox";


const sandbox = getSandbox(env.Sandbox, "docker-sandbox");


// Build an image
await sandbox.writeFile(
  "/workspace/Dockerfile",
  `
FROM alpine:latest
RUN apk add --no-cache curl
CMD ["echo", "Hello from Docker!"]
`,
);


const build = await sandbox.exec(
  "docker build --network=host -t my-image /workspace",
);
if (!build.success) {
  console.error("Build failed:", build.stderr);
}


// Run a container
const run = await sandbox.exec("docker run --network=host --rm my-image");
console.log(run.stdout); // "Hello from Docker!"
```

## Limitations

Docker-in-Docker in Cloudflare Containers has the following limitations:

* **No iptables** \- Network isolation features that rely on iptables are not available
* **Rootless mode only** \- You cannot use privileged containers or features requiring root
* **Ephemeral storage** \- Built images and containers are lost when the sandbox sleeps. You must persist them manually.

## Related resources

* [Dockerfile reference](https://edgetunnel-b2h.pages.dev/sandbox/configuration/dockerfile/) \- Customize your sandbox image
* [Execute commands](https://edgetunnel-b2h.pages.dev/sandbox/guides/execute-commands/) \- Run commands in the sandbox
* [Background processes](https://edgetunnel-b2h.pages.dev/sandbox/guides/background-processes/) \- Manage long-running processes

```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/sandbox/guides/docker-in-docker/#page","headline":"Run Docker-in-Docker · Cloudflare Sandbox SDK docs","description":"Run Docker commands inside a sandbox container.","url":"https://edgetunnel-b2h.pages.dev/sandbox/guides/docker-in-docker/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/dev-products-preview.png","dateModified":"2026-04-21","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/sandbox/","name":"Sandbox SDK"}},{"@type":"ListItem","position":3,"item":{"@id":"/sandbox/guides/","name":"How-to guides"}},{"@type":"ListItem","position":4,"item":{"@id":"/sandbox/guides/docker-in-docker/","name":"Run Docker-in-Docker"}}]}
```