> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Docker in a sandbox

> Start dockerd inside a microsandbox VM and run containers from an interactive shell

This example starts a complete Docker environment inside a microsandbox VM. It is useful for sandboxed builds, agent workflows that need their own Docker daemon, or experiments you do not want leaking onto the dev machine. The host's Docker setup, if any, is left untouched.

The command below boots the `docker:dind` image, starts Docker inside the sandbox, waits for it to be ready, and then opens an interactive shell. From there, Docker commands run against the daemon inside the sandbox, not your host.

## Run Docker in a sandbox

<Steps>
  <Step title="Start Docker">
    <Tooltip tip="On microsandbox cloud, create the named volume separately without disk-kind or size options, then omit replace-on-create from this command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

    <CodeGroup>
      ```sh macOS & Linux theme={null}
      msb run --name docker-demo --replace \
        --memory 2G \
        --mount-named docker-data:/var/lib/docker:kind=disk,size=10G \
        --script start='dockerd >/tmp/dockerd.log 2>&1 &
        timeout 60 sh -c "until docker info>/dev/null 2>&1;do sleep 1;done" || {
          cat /tmp/dockerd.log
          false
        }
        exec sh' \
        --entrypoint start \
        docker:dind
      ```

      ```powershell Windows theme={null}
      msb run --name docker-demo --replace `
        --memory 2G `
        --mount-named docker-data:/var/lib/docker:kind=disk,size=10G `
        --script start='dockerd >/tmp/dockerd.log 2>&1 &
        timeout 60 sh -c "until docker info>/dev/null 2>&1;do sleep 1;done" || {
          cat /tmp/dockerd.log
          false
        }
        exec sh' `
        --entrypoint start `
        docker:dind
      ```
    </CodeGroup>

    This command does three things:

    * Starts the `docker:dind` image in a sandbox named `docker-demo`.
    * Mounts a disk-backed named volume called `docker-data` at `/var/lib/docker`, where Docker stores images, containers, and build cache.
    * Runs the inline `start` script as the entrypoint. The script starts Docker, waits until it is ready, and then opens a shell.

    `--mount-named docker-data:/var/lib/docker:kind=disk,size=10G` is idempotent. If `docker-data` does not exist, the CLI creates it before starting the sandbox. If it already exists with compatible disk settings, the same command reuses it, so pulled images and created containers can survive `msb rm docker-demo`.
  </Step>

  <Step title="Optional: use a flat root disk">
    <Tooltip tip="Flat root disks are not available on microsandbox cloud."><span className="msb-badge-local">Local-only <Icon icon="circle-info" size={11} /></span></Tooltip>

    For a simpler local setup, use a flat root disk instead of a separate named volume. A flat root mounts ext4 directly, so Docker's overlay storage is not nested on the default sandbox OverlayFS.

    <CodeGroup>
      ```sh macOS & Linux theme={null}
      msb run --name docker-demo --replace \
        --memory 2G \
        --root-disk flat:10G \
        --script start='dockerd >/tmp/dockerd.log 2>&1 &
        timeout 60 sh -c "until docker info>/dev/null 2>&1;do sleep 1;done" || {
          cat /tmp/dockerd.log
          false
        }
        exec sh' \
        --entrypoint start \
        docker:dind
      ```

      ```powershell Windows theme={null}
      msb run --name docker-demo --replace `
        --memory 2G `
        --root-disk flat:10G `
        --script start='dockerd >/tmp/dockerd.log 2>&1 &
        timeout 60 sh -c "until docker info>/dev/null 2>&1;do sleep 1;done" || {
          cat /tmp/dockerd.log
          false
        }
        exec sh' `
        --entrypoint start `
        docker:dind
      ```
    </CodeGroup>

    This stores Docker's images, containers, and build cache on the sandbox's root disk. The data persists when the sandbox stops and starts, but unlike a named volume, it does not survive removing or replacing the sandbox. The `10G` capacity covers the entire root filesystem, including Docker's data.
  </Step>

  <Step title="Run a container">
    From the sandbox shell, run a nested Ubuntu container:

    ```sh theme={null}
    docker run -it --rm ubuntu bash
    ```

    You are now in a container running inside Docker, which is itself running inside the microsandbox VM. Exit the Ubuntu container with `exit` to return to the `docker-demo` sandbox shell.

    You can also verify the daemon with a short non-interactive command:

    ```sh theme={null}
    docker run --rm hello-world
    ```
  </Step>

  <Step title="Clean up">
    Exit the sandbox shell:

    ```sh theme={null}
    exit
    ```

    Back on the host, remove the sandbox:

    ```sh theme={null}
    msb rm -f docker-demo
    ```

    Remove the Docker data only when you no longer need it:

    ```sh theme={null}
    msb volume rm docker-data
    ```

    Remove `docker-data` only when you no longer need the images, containers, and build cache stored by the nested daemon.

    If you used the flat-root alternative, skip `msb volume rm docker-data`; removing the sandbox also removes its Docker data.
  </Step>
</Steps>

## Details

The disk-backed named mount gives Docker its own ext4 filesystem at `/var/lib/docker`. That matters because the sandbox root filesystem is already overlay-backed, and Docker's default storage driver also uses overlay layers. Keeping Docker's data root on a dedicated disk-backed volume avoids putting Docker's overlay storage directly on top of the sandbox root overlay.

## Notes

* **Memory.** The example uses `--memory 2G`. Increase it for larger builds or memory-hungry containers.
* **Not the same as [Sandbox in Docker](/examples/docker/docker).** That example covers the opposite direction.