aws-cdk: Support setting the container runtime in cdk.json #31319
Labels
@aws-cdk/core
Related to core CDK functionality
@aws-cdk/pipelines
CDK Pipelines library
effort/medium
Medium work item – several days of effort
feature-request
A feature should be added or improved.
p2
Describe the feature
The undocumented (#25657)
CDK_DOCKER
environment variable introduced by #23855 lets users specify the container runtime to use for Docker/OCI container image asset functionality in the AWS CDK.To make this portable, however, users need to rely on other environment management tools that support project-specific configurations which can be committed to source control such as Nix (
flake.nix
orshell.nix
), direnv (.envrc
), dotenv (.env
), or development containers.Instead of needing to set up these others tools, users should be able to set this option in their
cdk.json
which they are already committing to source control.Use Case
Some CI/CD pipelines use Docker/OCI container based environments where users specify a container image (contains a Linux userspace) to use as the build environment (e.g. AWS CodeBuild steps in AWS CodePipelines, GitLab Pipelines with runners using the Docker executor). That is, build jobs run inside a container.
Since the build job itself might need to use a container engine to build containers or run containerized services within the build environment for testing, users end up doing Docker-in-Docker (DinD).
DinD, however, has a lot of sharp edges. Some of these are related to the Docker daemon requiring escalated privileges.
Unless the CI/CD pipeline has a workaround like exposing the underlying host's Docker daemon Unix socket with a bind mount or running the build job in a privileged container (both are security vulnerabilities), users need to use an alternative container runtime like Podman which doesn't rely on a privileged daemon.
To make it easier to configure the AWS CDK to use an alternative container runtime in both local development and CI/CD environments, users should be able to set this option in their
cdk.json
. This file is already committed to source control for AWS CDK projects and is pulled into CI/CD environments as a result.Acknowledgements
CDK version used
2.155.0
Environment details (OS name and version, etc.)
macOS 14 (Sonoma)
The text was updated successfully, but these errors were encountered: