--- title: How I Built KodeKloud-Style Labs on EKS with Sysbox... description: A detailed engineering story about building KodeKloud-style interactive browser labs on EKS using Sysbox instead of Docker-in-Docker (DinD). The author... canonical: https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How I Built KodeKloud-Style Labs on EKS with Sysbox (Instead of Fighting DinD) | daily.dev og:description: A detailed engineering story about building KodeKloud-style interactive browser labs on EKS using Sysbox instead of Docker-in-Docker (DinD). The author... og:url: https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne og:image: https://api.daily.dev/og/posts/wkqdI6kne.png og:image:alt: How I Built KodeKloud-Style Labs on EKS with Sysbox (Instead of Fighting DinD) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How I Built KodeKloud-Style Labs on EKS with Sysbox (Instead of Fighting DinD) **[Medium](https://daily.dev/sources/medium_js)** · 22 min read · 2 upvotes · 0 comments ## Summary A detailed engineering story about building KodeKloud-style interactive browser labs on EKS using Sysbox instead of Docker-in-Docker (DinD). The author explains why privileged DinD fails at cohort scale across four dimensions: security, performance, cleanup, and cost. Sysbox solves this by using Linux user namespaces to remap container root to an unprivileged host UID, enabling nested Docker and kind clusters without --privileged. The architecture covers: a warm pod pool with balloon pods for instant startup, namespace-per-session isolation, default-deny egress with IMDS blocking, a registry mirror to prevent Docker Hub rate limits, Karpenter tuning with WhenEmpty consolidation to avoid evicting live sessions, and four-layer cleanup (broker, idle timeout, CronJob janitor, activeDeadlineSeconds). Specific gotchas documented include: containerd 2.x requiring hostUsers: false, Sysbox rejecting SYSBOX_*-shaped service env vars (fix: enableServiceLinks: false), a Terraform module silently dropping CNI policy, ALB target type and security group traps, and health check matcher issues with ttyd's 401 response. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Sysbox make it possible to run Docker inside a Kubernetes pod without using privileged mode? Sysbox is a container runtime that plugs in as a Kubernetes RuntimeClass alongside runc. A pod opts in with runtimeClassName: sysbox-runc, and the Linux user namespace remaps container root to an unprivileged host UID (for example, UID 0 in the container maps to host UID 2,173,632,512). Docker and systemd then run inside the pod without --privileged or CAP_SYS_ADMIN, so an escape lands as an unprivileged nobody rather than host root. _Anyone hardening multi-tenant Docker workloads can track Sysbox and container isolation deep dives on daily.dev._ ### Why does Sysbox fail to start a pod on containerd 2.x with a sysfs mount error? On containerd 2.x, Sysbox requires the pod to use native user namespaces, and leaving that setting off produces an opaque error like 'mounting sysfs to rootfs caused: mount through procfd: operation not permitted' and the sandbox never starts. The fix is adding hostUsers: false to the pod spec, which is required specifically because of the containerd 1.x to 2.x cutover changing how user namespaces are handled. _Teams migrating container runtimes can follow version-specific gotchas like this one on daily.dev._ ### Why does a Kubernetes NetworkPolicy have no effect on EKS even though it's applied correctly? On EKS, NetworkPolicy objects are accepted by the API server but silently never enforced unless the VPC CNI has network policy enforcement explicitly enabled. The fix is setting enableNetworkPolicy to true in the vpc-cni addon configuration; without it, a default-deny egress rule intended to block access to the instance metadata service at 169.254.169.254 does nothing at all. _Engineers locking down pod egress on EKS can dig into enforcement gaps like this on daily.dev._ ## Similar posts on daily.dev - [The System Design Behind My New SaaS](https://daily.dev/posts/the-system-design-behind-my-new-saas-n2rai39sp) · Milan Jovanović · 49 upvotes · 6 comments - [⬢ Distrobox: An In-depth Guide for Developers - Part 1](https://daily.dev/posts/distrobox-an-in-depth-guide-for-developers---part-1-o1vg9vhiu) · KDAB Blog · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How I Built KodeKloud-Style Labs on EKS with Sysbox (Instead of Fighting DinD)","url":"https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne"},"datePublished":"2026-07-26T19:32:12.227Z","dateModified":"2026-09-14T09:06:07.233Z","description":"A detailed engineering story about building KodeKloud-style interactive browser labs on EKS using Sysbox instead of Docker-in-Docker (DinD). The author...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb4d2529529b10484ccf854a3b5a71c7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb4d2529529b10484ccf854a3b5a71c7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,kubernetes","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"How I Built KodeKloud-Style Labs on EKS with Sysbox (Instead of Fighting DinD)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-i-built-kodekloud-style-labs-on-eks-with-sysbox-instead-of-fighting-dind--wkqdi6kne#faq","mainEntity":[{"@type":"Question","name":"How does Sysbox make it possible to run Docker inside a Kubernetes pod without using privileged mode?","acceptedAnswer":{"@type":"Answer","text":"Sysbox is a container runtime that plugs in as a Kubernetes RuntimeClass alongside runc. A pod opts in with runtimeClassName: sysbox-runc, and the Linux user namespace remaps container root to an unprivileged host UID (for example, UID 0 in the container maps to host UID 2,173,632,512). Docker and systemd then run inside the pod without --privileged or CAP_SYS_ADMIN, so an escape lands as an unprivileged nobody rather than host root. Anyone hardening multi-tenant Docker workloads can track Sysbox and container isolation deep dives on daily.dev."}},{"@type":"Question","name":"Why does Sysbox fail to start a pod on containerd 2.x with a sysfs mount error?","acceptedAnswer":{"@type":"Answer","text":"On containerd 2.x, Sysbox requires the pod to use native user namespaces, and leaving that setting off produces an opaque error like 'mounting sysfs to rootfs caused: mount through procfd: operation not permitted' and the sandbox never starts. The fix is adding hostUsers: false to the pod spec, which is required specifically because of the containerd 1.x to 2.x cutover changing how user namespaces are handled. Teams migrating container runtimes can follow version-specific gotchas like this one on daily.dev."}},{"@type":"Question","name":"Why does a Kubernetes NetworkPolicy have no effect on EKS even though it's applied correctly?","acceptedAnswer":{"@type":"Answer","text":"On EKS, NetworkPolicy objects are accepted by the API server but silently never enforced unless the VPC CNI has network policy enforcement explicitly enabled. The fix is setting enableNetworkPolicy to true in the vpc-cni addon configuration; without it, a default-deny egress rule intended to block access to the instance metadata service at 169.254.169.254 does nothing at all. Engineers locking down pod egress on EKS can dig into enforcement gaps like this on daily.dev."}}]} ```