Using Docker in a Kasm Desktop

Overview

Developers often need to build and run Docker containers from within a browser-based environment. This guide configures a Kasm Workspaces desktop that runs Docker inside the disposable workspace container. You choose between a more secure rootless image and a higher-performance root image, create the workspace with privileged permissions, and tune storage for better input and output performance. As a result, developers gain a self-contained Docker environment that streams to the browser and resets cleanly between sessions.

Prerequisites

Before you begin, confirm the following:

• Administrator access to the Kasm Workspaces deployment, with permission to create and edit Workspaces.
• A decision on whether to run the rootless or root Docker image. Review Choose rootless or root Docker before you continue.
• An understanding that running Docker inside a workspace requires privileged permissions. Privileged containers carry security risk, so reserve the root image for development deployments.

Solution approach

This guide progresses through the following phases:

1. Choose rootless or root Docker.
2. Configure the workspace.
3. Tune storage and performance.

Detailed steps

Choose rootless or root Docker

Kasm Workspaces provides two families of Docker-in-Docker images. The choice balances security against performance and capability.

The recommended, more secure option is a rootless Docker image. The Docker daemon does not run as root, which mitigates the impact of using --privileged. The following rootless images are available:

• kasmweb/ubuntu-focal-dind-rootless
• kasmweb/ubuntu-jammy-dind-rootless
• kasmweb/ubuntu-noble-dind-rootless

The rootless container has two limitations. It prevents users from exposing ports with a number lower than 1024. It is also limited to the vfs storage driver regardless of what the underlying host supports, which adds input and output overhead and lowers performance compared to the root image.

The root option runs the Docker daemon as root inside the workspace. Running the daemon as root is insecure, so reserve this option for development deployments. The root image removes some limitations of the rootless workspace. The following root images are available:

• kasmweb/ubuntu-focal-dind
• kasmweb/ubuntu-jammy-dind
• kasmweb/ubuntu-noble-dind

Privileged permissions are required

Use of Docker inside a Kasm desktop requires the desktop to be launched with privileged permissions. Running the daemon as root makes it trivial for a user to run commands as root on the host machine.

Configure the workspace

1. Log into your Kasm Workspaces deployment as an administrator.
2. Go to Workspaces > Workspaces and click Add Workspace.
3. Configure the Workspace with the settings in the following table.
4. Save the Workspace.

Field	Value
Docker Image	kasmweb/ubuntu-focal-dind:[[release]] or kasmweb/ubuntu-focal-dind-rootless:[[release]] or kasmweb/ubuntu-jammy-dind:[[release]] or kasmweb/ubuntu-jammy-dind-rootless:[[release]] or kasmweb/ubuntu-noble-dind:[[release]] or kasmweb/ubuntu-noble-dind-rootless:[[release]]
Description	Docker in a Kasm Desktop
Friendly Name	Docker
Cores	1
Memory	1768
Enabled	True
Docker Registry	https://index.docker.io/v1/
Docker Run Config	{"privileged":true}

After you create the Workspace, launch it by clicking the Docker workspace on the User Dashboard.

Tune storage and performance

When you run Docker in Docker, the default storage driver is fuse-overlayfs if the storage for the isolated Docker daemon is contained within a Docker volume. To leverage host-supported filesystem drivers such as overlay2, mount the Docker storage directory to the host filesystem. The mount path depends on the image type:

Image Type	Docker Storage Path
Rootless	/home/kasm-user/.local/share/docker
Root	/var/lib/docker

note

When using Persistent Profiles with a rootless image, this mapping happens automatically. The home directory for the user is mounted out of the ephemeral container volume.

To check which storage driver the container is running, run the following command:

docker system info | grep "Storage Driver"

Common troubleshooting steps

• The workspace fails to launch or Docker does not start. Confirm that the Docker Run Config is set to {"privileged":true}. Docker in Docker requires privileged permissions to run.
• Ports below 1024 cannot be exposed. The rootless image cannot expose ports with a number lower than 1024. Use the root image for development if low-numbered ports are required.
• Container performance is slow. The rootless image is limited to the vfs storage driver, which adds input and output overhead. Mount the Docker storage directory to the host filesystem to use a host-supported driver such as overlay2.
• The storage driver is not the expected driver. Run docker system info | grep "Storage Driver" to confirm the active driver. If it reports vfs or fuse-overlayfs when overlay2 is expected, verify that the Docker storage path is mounted to the host filesystem.