Docker

Docker Desktop vs Docker Engine

Linux socket permissions

On Linux, the Docker socket is owned by root and the docker group. By default, only root can access it. Add your user to the docker group to use Docker without sudo.

# Option 1: Add your user to the docker group (persistent)
sudo usermod -aG docker $USER
# Log out and back in, or run:
newgrp docker

# Option 2: Change socket permissions (not recommended for production)
sudo chmod 666 /var/run/docker.sock

# Verify
docker ps

Members of the docker group have root-equivalent access to the Docker daemon. Only add trusted users to this group.

Remote Docker host

Conductor can connect to a Docker daemon on a remote machine over TCP. Always use TLS when exposing Docker over TCP on a network — an unauthenticated Docker TCP port gives full root access to the host machine.

# Set DOCKER_HOST for the current session
export DOCKER_HOST=tcp://192.168.1.100:2376

# With TLS (recommended for remote hosts)
export DOCKER_HOST=tcp://192.168.1.100:2376
export DOCKER_TLS_VERIFY=1
export DOCKER_CERT_PATH=~/.docker/certs/my-remote-host

Docker context

Docker contexts let you save and switch between multiple Docker endpoints. Conductor respects the active Docker context, or you can pin a specific context in the config.

# Create a Docker context for a remote host
docker context create remote-server \
  --docker "host=tcp://192.168.1.100:2376,ca=/path/to/ca.pem,cert=/path/to/cert.pem,key=/path/to/key.pem"

# Use the context
docker context use remote-server

# Conductor picks up the active Docker context automatically
# Or specify explicitly in config with the "context" field:
{
  "plugins": {
    "docker": {
      "context": "remote-server"
    }
  }
}

Conductor config

{
  "plugins": {
    "docker": {
      "socketPath": "/var/run/docker.sock"
    }
  }
}

{
  "plugins": {
    "docker": {
      "socketPath": "//./pipe/docker_engine"
    }
  }
}

{
  "plugins": {
    "docker": {
      "host": "tcp://192.168.1.100:2376",
      "tlsCertPath": "/path/to/certs"
    }
  }
}

Available tools

Running Conductor inside Docker

You can run Conductor itself as a Docker container. Mount the host Docker socket into the container so Conductor can manage the host's Docker daemon. This is sometimes called "Docker-in-Docker" but is actually Docker-outside-Docker — the container uses the host daemon.

# Run Conductor inside Docker, mounting the host Docker socket
docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.conductor:/root/.conductor \
  -p 3000:3000 \
  useconductor/conductor:latest

# The mounted socket lets Conductor control the host's Docker daemon.
# Note: this grants significant privilege — treat it like root access.

Resource constraints

The docker.container.exec tool runs commands inside existing containers and inherits that container's resource limits. The docker.image.build tool streams build output and may take significant time for large images. Conductor does not impose additional CPU or memory limits — those are set in Docker Desktop settings (Mac/Windows) or via cgroup limits on Linux. Set --memory and --cpus flags when creating containers if you need hard limits.

Common errors