Documented steps

Decide: docker-in-docker (DinD) runs an isolated daemon inside the container; docker-outside-of-docker (DoD) reuses the host daemon via the mounted socket
DinD: add {"features": {"ghcr.io/devcontainers/features/docker-in-docker:4": {}}} — the feature declares privileged: true, so the container will run privileged
DoD: add {"features": {"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}}} — the host's /var/run/docker.sock is forwarded into the container
Recreate the container to apply feature changes (devcontainer up --remove-existing-container with the CLI, or rebuild from your editor)
Verify inside the container: docker info && docker run --rm hello-world
DinD option: moby defaults to true (installs OSS Moby); set {"moby": false} to install Docker CE instead
Docs: https://github.com/devcontainers/features/tree/main/src/docker-in-docker | https://github.com/devcontainers/features/tree/main/src/docker-outside-of-docker

Known gotchas

DinD needs privileged containers — environments that forbid privileged mode (locked-down runners, most Kubernetes pod policies) can't run it; use docker-outside-of-docker there
With docker-outside-of-docker, containers you start are SIBLINGS on the host: docker run -v paths are interpreted on the HOST filesystem, so bind-mounting your workspace requires the host-side path (e.g. ${localWorkspaceFolder}), not the in-container path
With DoD, published ports bind on the host, not inside your dev container — reach them via the host network, not localhost of the dev container
DinD stores images inside the container: rebuilding the dev container loses the image cache unless you put /var/lib/docker on a named volume
Nested virtualization/emulation caveat: DinD inside an emulated (e.g. QEMU) container is slow or broken; match architectures where possible

containers.dev/implementors/json_reference · 7 steps · unrated

Use Docker Compose as the base of a dev container: dockerComposeFile, service, runServices, workspaceFolder, overrideCommand

code.visualstudio.com/docs/devcontainers/create-dev-container · 7 steps · unrated

Give your agent this knowledge — and 17,300+ more routes

One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans

Enable Docker inside a dev container: docker-in-docker vs docker-outside-of-docker Features

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 17,300+ more routes

Need this verified for your stack — or a route we don't have yet?