docker-in-docker on wslc: why it fails
Docker-in-Docker (DinD) inside a wslc container does not work reliably in 2.9.4.0. The blocker is a missing capability: wslc cannot bind-mount a WSL host path into a container the way Docker can. This is tracked as microsoft/WSL #40957.
## What breaks The most common trigger is the VS Code Dev Containers docker-in-docker feature. When a devcontainer includes the feature, it passes a socket bind to the container: ```powershell -v /var/run/docker.sock:/var/run/docker-host.sock ``` wslc rejects or mishandles this bind mount, so the inner Docker daemon either cannot start or cannot be reached. The result is a devcontainer that builds but fails every docker command. The issue affects any DinD scenario that depends on mounting the Docker socket or a WSL distro path — not just VS Code. The reporter's exact stack: - VS Code with the Dev Containers extension - A devcontainer usingghcr.io/devcontainers/features/docker-in-docker:2
- Which adds -v /var/run/docker.sock:/var/run/docker-host.sock to the run args
## Why wslc cannot do it
wslc's bind mounts are designed around Windows host paths shared over VirtioFS
(C:/work:/app). Two gaps block DinD:
1. No WSL-distro path mounting — you cannot reference
/var/run/docker.sock or a path from inside a WSL distro as the source of a
-v mount.
2. No socket passthrough — even if the mount were accepted, there is nothing
listening on that socket inside a wslc session (wslc is daemonless).
The issue also notes there is no --privileged or --device flag as an
escape hatch (see the privileged & fuse page).
## Workarounds
**Option A — a real Docker daemon outside wslc.** Install Docker Engine inside a normal WSL
distro (free, no Docker Desktop licence) and point inner tools at it via
DOCKER_HOST. wslc and that daemon coexist. Details on the
Docker socket & DOCKER_HOST page.
**Option B — keep Docker Desktop for DinD workloads.** Use wslc for single-container dev and
Docker Desktop for anything that genuinely needs Docker-in-Docker. The two runtimes coexist
(the cost is duplicated images).
**Option C — avoid DinD entirely.** Refactor the build to run docker commands against a daemon
you control outside the container, or use a tool that shells out to a CLI you translate (the
command converter handles the docker→wslc mapping).
## Track the fix
Follow microsoft/WSL #40957. When
wslc adds WSL-host-path bind mounting or a socket passthrough, the DinD feature will start
working and this page will change.