This example shows how you can use Dagger to spin up a DinD (Docker in Docker) container instance and use that from other container steps. It could be building a containers in your pipeline in one step and then security scan it in another, but still use the same "simi local" daemon.

First we prepare and start the Dagger engine

ctx := context.Background()
client, _ := dagger.Connect(ctx, dagger.WithLogOutput(os.Stdout))
defer client.Close()

We then create a cache called certCache to be used to keep the certificates generated by the DinD container, so they can be used / shared with the other container steps. They need this to be able to connect via tcp to the Docker daemon The dockerState cache is to keep the docker state

certCache := client.CacheVolume("node")
dockerState := client.CacheVolume("docker-state")

We then prepare and start the Docker daemon (DinD) container.

docker, _ := client.Container().
    From("docker:dind").

We expose the port 2376 to be used by the other containers to connect to the docker daemon

    WithExposedPort(2376).

We then make a cache mount for the docker data directory

    WithMountedCache("/var/lib/docker", dockerState, dagger.ContainerWithMountedCacheOpts{
	Sharing: dagger.Private,
    }).

We mount our cerCache cache where the container generates certificates that the other containers need to use, to safely connect to the docker daemon via TPC

    WithMountedCache("/certs", certCache).

The empy "WithExec" is to force the dind container to be privileged, which it needs.

    WithExec(nil, dagger.ContainerWithExecOpts{
        InsecureRootCapabilities: true,
    }).

And then we start it in the background so it keeps on running.

    AsService().
    Start(ctx)

We create a runner where we set all the environment variables we need, the service binding to the DinD container and what base container image to use. This is done to make it more simple when we actually run a container

runner := client.Container().
    From("docker:latest").
    WithServiceBinding("docker", docker).
    WithMountedCache("/certs", certCache).
    WithEnvVariable("DOCKER_HOST", "tcp://docker:2376").
    WithEnvVariable("DOCKER_TLS_CERTDIR", "/certs").
    WithEnvVariable("DOCKER_CERT_PATH", "/certs/client").
    WithEnvVariable("DOCKER_TLS_VERIFY", "1")

This first example show how little we need to write to run a container, as all the configuration is in place. We use a errgroup to run to container simutanously. They both run a docker pull command from inside the container. These docker commands demonstrates that we can communicate with the docker daemon in the dind container.

group.Go(func() error {
    _, _ = runner.
        WithExec([]string{"docker", "pull", "busybox"}).
        Sync(ctx)
    return nil
})

group.Go(func() error {
    _, _ = runner.
        WithExec([]string{"docker", "pull", "alpine"}).
        Sync(ctx)
    return nil
})

if err := group.Wait(); err != nil {
    fmt.Printf("errgroup tasks ended up with an error: %v\n", err)
} else {
    fmt.Println("all works done successfully")
}

The last docker example show that the two fist examples actually works. This will list docker images in the dind container.

_, _ = runner.
    WithExec([]string{"docker", "images"}).
    Sync(ctx)