move-server.sh: --docker-sock to give the container the target's Docker

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/move-server.sh

@@ -27,6 +27,10 @@
 #                        (/data/home), the users' homes (/data/users) and /tmp are bind
 #                        mounts from DIR/home, DIR/users and DIR/tmp (default: inside <dir>/data)
 #   --uid N --gid N      owner of data and workspace on the target (default: UID/GID of .env)
+#   --docker-sock        give the container the target's Docker (bind mount of
+#                        /var/run/docker.sock plus its group). Root-equivalent access to the
+#                        target host for admins' agents and terminals; sandboxed users do not
+#                        see it, and docker commands still need approval
 #   --port N             host port on the target (default: PORT of .env)
 #   --bind ADDR          bind address on the target (default: BIND_ADDR of .env or 127.0.0.1)
 #   --name NAME          container name on the target (default codecraft)
@@ -37,12 +41,13 @@
 #   --dry-run            show the steps only
 set -euo pipefail
 
-target="" ws_target="" tools_dir="" uid="" gid="" port="" bind="" name="codecraft"
+target="" ws_target="" tools_dir="" docker_sock=0 uid="" gid="" port="" bind="" name="codecraft"
 src_container="codecraft" src_volume="codecraft-data" ws_source="" stop=1 dry=0
 while (($#)); do
   case "$1" in
     --workspace) ws_target="$2"; shift ;;
     --tools-dir) tools_dir="$2"; shift ;;
+    --docker-sock) docker_sock=1 ;;
     --uid) uid="$2"; shift ;;
     --gid) gid="$2"; shift ;;
     --port) port="$2"; shift ;;
@@ -137,8 +142,15 @@ fi
 step "Copying the workspace (changes since the first pass)"
 sync_workspace
 remote "chown -R $uid:$gid $(q "$dir/data") $(q "$ws_target") ${tools_dir:+$(q "$tools_dir/home") $(q "$tools_dir/users")} 2>/dev/null || echo 'note: could not chown (not root) – check file owners'"
-# Bind mounts for the tools disk (compose lines and docker run flags).
-tool_mounts="" tool_flags=""
+# Bind mounts for the tools disk and the Docker socket (compose lines and docker run flags).
+tool_mounts="" tool_flags="" sock_compose="" sock_flags=""
+if (( docker_sock )); then
+  if (( dry )); then sock_gid=0; else
+    sock_gid=$(remote "stat -c %g /var/run/docker.sock") || fail "no /var/run/docker.sock on the target"
+  fi
+  sock_compose=$(printf '      - /var/run/docker.sock:/var/run/docker.sock\n    group_add:\n      - "%s"\n' "$sock_gid")
+  sock_flags="-v /var/run/docker.sock:/var/run/docker.sock --group-add $sock_gid "
+fi
 if [[ -n "$tools_dir" ]]; then
   tool_mounts=$(printf '      - %s/home:/data/home\n      - %s/users:/data/users\n      - %s/tmp:/tmp\n' "$tools_dir" "$tools_dir" "$tools_dir")
   tool_flags="-v $tools_dir/home:/data/home -v $tools_dir/users:/data/users -v $tools_dir/tmp:/tmp "
@@ -168,6 +180,7 @@ services:
       - $dir/data:/data
       - \${WORKSPACE}:/workspace
 $tool_mounts
+$sock_compose
     extra_hosts:
       - "host.docker.internal:host-gateway"
     shm_size: "1gb"
@@ -186,7 +199,7 @@ val() { sed -n "s/^\$1=//p" .env | tail -1; }
 docker rm -f $name >/dev/null 2>&1 || true
 exec docker run -d --name $name --restart unless-stopped --user "\$(val UID):\$(val GID)" \\
   -p "\$(val BIND_ADDR):\$(val PORT):8787" --env-file .env \\
-  -v $dir/data:/data -v "\$(val WORKSPACE):/workspace" $tool_flags\\
+  -v $dir/data:/data -v "\$(val WORKSPACE):/workspace" $tool_flags$sock_flags\\
   --add-host host.docker.internal:host-gateway --shm-size 1g \\
   --security-opt seccomp=$dir/docker/seccomp-sandbox.json \\
   --security-opt apparmor=unconfined --security-opt systempaths=unconfined \\