From 1596a7ca2179d23b3dd02d8c276e6ff35eda90e6 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 8 Sep 2026 19:43:05 +0200 Subject: [PATCH 1/4] dind: remove zfs dependency The zfs utilities were used by the zfs graph-driver. containerd provides an optional zfs-snapshotter, but it's not installed by default. Remove the dependency, as it's not used in the default configuration. Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 1 - Dockerfile-dind.template | 1 - 2 files changed, 2 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index a6a1802fb..837ea2b3f 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -17,7 +17,6 @@ RUN set -eux; \ pigz \ shadow-uidmap \ xz \ - zfs \ ; # dind might be used on systems where the nf_tables kernel module isn't available. In that case, diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 1767d0bf4..873144424 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -12,7 +12,6 @@ RUN set -eux; \ pigz \ shadow-uidmap \ xz \ - zfs \ ; # dind might be used on systems where the nf_tables kernel module isn't available. In that case, From 00dff1df7f1097f4b2229ce9c1b9a8e712fe224c Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Sat, 15 Aug 2026 17:36:34 +0200 Subject: [PATCH 2/4] remove containerd, ctr and use embedded containerd before/after: docker image ls dind IMAGE ID DISK USAGE CONTENT SIZE EXTRA dind:before 6f84404d1f9d 528MB 137MB dind:latest 5ac80767b941 436MB 112MB Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 4 ++-- 29/dind/dockerd-entrypoint.sh | 2 ++ Dockerfile-dind.template | 4 ++-- dockerd-entrypoint.sh | 2 ++ 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index 837ea2b3f..d84d26ae3 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -79,12 +79,12 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:29-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ + --exclude 'docker/containerd' \ + --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ - containerd --version; \ - ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind diff --git a/29/dind/dockerd-entrypoint.sh b/29/dind/dockerd-entrypoint.sh index 77ff1aab3..ad0a663f8 100755 --- a/29/dind/dockerd-entrypoint.sh +++ b/29/dind/dockerd-entrypoint.sh @@ -124,6 +124,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ + --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -135,6 +136,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ + --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 873144424..02f1c322b 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -64,12 +64,12 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:{{ env.version }}-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ + --exclude 'docker/containerd' \ + --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ - containerd --version; \ - ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh index 77ff1aab3..ad0a663f8 100755 --- a/dockerd-entrypoint.sh +++ b/dockerd-entrypoint.sh @@ -124,6 +124,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ + --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -135,6 +136,7 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ + --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi From b7dfe60d090eca6c4338d5759f78e7c3ae4397c9 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 4 Sep 2026 14:53:17 +0200 Subject: [PATCH 3/4] fixup! remove containerd, ctr and use embedded containerd Signed-off-by: Sebastiaan van Stijn --- 29/dind/dockerd-entrypoint.sh | 2 -- dockerd-entrypoint.sh | 2 -- 2 files changed, 4 deletions(-) diff --git a/29/dind/dockerd-entrypoint.sh b/29/dind/dockerd-entrypoint.sh index ad0a663f8..77ff1aab3 100755 --- a/29/dind/dockerd-entrypoint.sh +++ b/29/dind/dockerd-entrypoint.sh @@ -124,7 +124,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ - --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -136,7 +135,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ - --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh index ad0a663f8..77ff1aab3 100755 --- a/dockerd-entrypoint.sh +++ b/dockerd-entrypoint.sh @@ -124,7 +124,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2376 \ - --feature "embedded-containerd" \ --tlsverify \ --tlscacert "$DOCKER_TLS_CERTDIR/server/ca.pem" \ --tlscert "$DOCKER_TLS_CERTDIR/server/cert.pem" \ @@ -136,7 +135,6 @@ if [ "$#" -eq 0 ] || [ "${1#-}" != "$1" ]; then set -- dockerd \ --host="$dockerSocket" \ --host=tcp://0.0.0.0:2375 \ - --feature "embedded-containerd" \ "$@" DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="${DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS:-} -p 0.0.0.0:2375:2375/tcp" fi From f00b3c6c389f260f970bff708741320c34738e3b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 8 Sep 2026 20:59:57 +0200 Subject: [PATCH 4/4] fixup! remove containerd, ctr and use embedded containerd Signed-off-by: Sebastiaan van Stijn --- 29/dind/Dockerfile | 3 ++- Dockerfile-dind.template | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/29/dind/Dockerfile b/29/dind/Dockerfile index d84d26ae3..7d5d970cb 100644 --- a/29/dind/Dockerfile +++ b/29/dind/Dockerfile @@ -79,12 +79,13 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:29-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ +# exclude containerd, relying on the "embedded containerd" instead: https://github.com/moby/moby/pull/53388 (makes for a smaller image) --exclude 'docker/containerd' \ - --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ + ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind diff --git a/Dockerfile-dind.template b/Dockerfile-dind.template index 02f1c322b..1f97cfa51 100644 --- a/Dockerfile-dind.template +++ b/Dockerfile-dind.template @@ -64,12 +64,13 @@ RUN set -eux; \ --no-same-owner \ # we exclude the CLI binary because we already extracted that over in the "docker:{{ env.version }}-cli" image that we're FROM and we don't want to duplicate those bytes again in this layer --exclude 'docker/docker' \ +# exclude containerd, relying on the "embedded containerd" instead: https://github.com/moby/moby/pull/53388 (makes for a smaller image) --exclude 'docker/containerd' \ - --exclude 'docker/ctr' \ ; \ rm docker.tgz; \ \ dockerd --version; \ + ctr --version; \ runc --version # https://github.com/docker/docker/tree/master/hack/dind