> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/harness-security-scanners/shared/dind-bg-step.md).

# Dind Bg Step

The following use cases require a Docker-in-Docker background step in your pipeline:

* Container image scans on Kubernetes and Docker build infrastructures
  * Required for [Orchestration](/security-testing-orchestration/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md) and Dataload scan modes
* [Custom Scan steps](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) on Kubernetes and Docker build infrastructures
  * Required for all target types and Orchestration/DataLoad modes

The following use cases do not require a Docker-in-Docker background step:

* Harness Cloud AMD64 build infrastructures
* SAST/DAST/configuration scans that use a scanner-specific step and not a Custom Scan step.
* [Ingestion scans](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md) where the data file has already been generated

<details>

<summary>Set up a Docker-in-Docker background step</summary>

1. Go to the stage where you want to run the scan.
2. In **Overview**, add the shared path `/var/run`.
3. In **Execution**, do the following:
   1. Click **Add Step** and then choose **Background**.
   2. Configure the Background step as follows:
      1. Dependency Name = `dind`
      2. Container Registry = The Docker connector to download the DinD image. If you don't have one defined, go to [Docker connector settings reference](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/docker-registry-connector-settings-reference.md).
      3. Image = `docker:dind`
      4. Under **Entry Point**, add the following: `dockerd`

         In most cases, using `dockerd` is a faster and more secure way to set up the background step. For more information, go to the **TLS** section in the [Docker quick reference](https://hub.docker.com/_/docker).

         If the DinD service doesn't start with `dockerd`, clear the **Entry Point** field and then run the pipeline again. This starts the service with the default [entry point](https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime).
      5. Under **Additional Configuration**, select the **Privileged** checkbox.

Add a Background step to your pipeline and set it up as follows:- step: type: Background name: background-dind-service identifier: Background\_1 spec: connectorRef: CONTAINER\_IMAGE\_REGISTRY\_CONNECTOR image: docker:dind shell: Sh entrypoint: - dockerd privileged: true

</details>