move-server.sh: --docker-sock to give the container the target's Docker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/MOVING.md

@@ -47,6 +47,7 @@ Decide:
 | Folder for agent installs and `/tmp` | `--tools-dir` | `/mnt/disks/ssd/codecraft` |
 | Your projects | `--workspace` | `/mnt/user/projects` |
 | Owner of files (the container runs as this user) | `--uid`, `--gid` | Unraid default `99`/`100` (nobody:users); today `1000`/`1000` |
+| Docker of the new host for agents and terminals | `--docker-sock` | bind mount of `/var/run/docker.sock` plus its group (see below) |
 | Port and address | `--port`, `--bind` | `8787`; `0.0.0.0` if the reverse proxy runs on another machine or in another Docker network, `127.0.0.1` if it runs on the same host with host networking |
 
 ## Moving
@@ -57,12 +58,12 @@ On the **current host**, in the repository folder (where `.env` is):
 # 1. Look at the steps first (changes nothing)
 scripts/move-server.sh root@unraid:/mnt/user/appdata/codecraft \
   --workspace /mnt/user/projects --tools-dir /mnt/disks/ssd/codecraft \
-  --uid 99 --gid 100 --bind 0.0.0.0 --dry-run
+  --uid 99 --gid 100 --bind 0.0.0.0 --docker-sock --dry-run
 
 # 2. Move (same command without --dry-run)
 scripts/move-server.sh root@unraid:/mnt/user/appdata/codecraft \
   --workspace /mnt/user/projects --tools-dir /mnt/disks/ssd/codecraft \
-  --uid 99 --gid 100 --bind 0.0.0.0
+  --uid 99 --gid 100 --bind 0.0.0.0 --docker-sock
 ```
 
 What happens:
@@ -93,6 +94,21 @@ Afterwards:
 - **Clean up** on the old host when everything works: `docker rm codecraft`, later
   `docker volume rm codecraft-data`.
 
+## Docker socket (`--docker-sock`)
+
+With `--docker-sock` the container gets the new host's Docker: `/var/run/docker.sock` is bind
+mounted and the container joins the socket's group (the script reads its group id on the
+target). This is **root-equivalent access to the host**: whoever can start containers can mount
+any host folder.
+
+- Admins' agents and terminals (they run without sandbox) can use it.
+- Sandboxed users do not see the socket (the sandbox does not mount `/var/run`).
+- `docker` and `docker-compose` commands always need an approval, except in *bypass* mode.
+- The image has no Docker CLI; agents install the static CLI into their home when they need it
+  (on the tools disk with `--tools-dir`).
+
+The current host has the same setup in its local `docker-compose.override.yml` (group 997).
+
 ## Rollback
 
 Nothing is deleted on the old host. On Unraid stop the new container (`docker stop codecraft`),