Docker CLI in the image (static client for a mounted host socket)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,9 @@ until 1.0, minor versions may contain breaking changes.
 
 ### Added
 
+- The image contains the Docker CLI (static client). With the host's `/var/run/docker.sock`
+  mounted (and its group), admins' agents and terminals can use the host's Docker;
+  `scripts/move-server.sh --docker-sock` sets this up on a new host.
 - `scripts/move-server.sh --tools-dir DIR`: agent home, users' homes and `/tmp` on a separate disk.
 
 ## [v202611-00005] – 2026-11-09

Dockerfile

@@ -67,6 +67,14 @@ RUN mkdir -p server/src && echo 'fn main(){}' > server/src/main.rs \
     && mkdir -p /out && cp target/x86_64-unknown-linux-musl/release/codecraft /out/codecraft-linux-x86_64 \
     && cp target/aarch64-unknown-linux-musl/release/codecraft /out/codecraft-linux-aarch64
 
+# --- Docker CLI (static client; the daemon is the host's via the mounted socket) --
+FROM toolchain AS dockercli
+ARG TARGETARCH
+ARG DOCKER_VERSION=29.9.3
+RUN case "$TARGETARCH" in amd64) arch=x86_64 ;; arm64) arch=aarch64 ;; *) echo "unsupported $TARGETARCH" >&2; exit 1 ;; esac \
+    && curl -fsSL "https://download.docker.com/linux/static/stable/$arch/docker-$DOCKER_VERSION.tgz" | tar -xz -C /tmp docker/docker \
+    && install -m 0755 /tmp/docker/docker /docker
+
 # --- runtime ------------------------------------------------------------------
 # Node is included so agents can work on JS projects and run npx-based MCP servers.
 FROM node:22-bookworm-slim
@@ -85,6 +93,8 @@ RUN npm install -g typescript@5 typescript-language-server pyright && npm cache
 COPY --from=server /codecraft /usr/local/bin/codecraft
 COPY --from=web /web/dist /app/web
 COPY --from=cli /out /app/cli
+# Used with a mounted /var/run/docker.sock (see docs/MOVING.md, --docker-sock).
+COPY --from=dockercli /docker /usr/local/bin/docker
 COPY server/ghidra /app/ghidra
 COPY server/resources /app/resources
 # The agent's home lives on the data volume: tools it installs in user space

docs/MOVING.md

@@ -104,8 +104,7 @@ any host folder.
 - Admins' agents and terminals (they run without sandbox) can use it.
 - Sandboxed users do not see the socket (the sandbox does not mount `/var/run`).
 - `docker` and `docker-compose` commands always need an approval, except in *bypass* mode.
-- The image has no Docker CLI; agents install the static CLI into their home when they need it
-  (on the tools disk with `--tools-dir`).
+- The image contains the Docker CLI (static client); the daemon is the host's.
 
 The current host has the same setup in its local `docker-compose.override.yml` (group 997).
 

web/src/whatsnew.ts

@@ -3,6 +3,10 @@
  * under "unreleased"; scripts/release.sh renames the key to the release version.
  */
 export const WHATS_NEW: Record<string, { en: string[]; de: string[] }> = {
+  unreleased: {
+    en: ["Docker CLI in the image – with the host's Docker socket mounted, admins' agents and terminals can use Docker"],
+    de: ["Docker-CLI im Image – mit eingehängtem Docker-Socket können Admin-Agents und -Terminals Docker nutzen"],
+  },
   "202611-00005": {
     en: ["Agents commit with the git name and e-mail from your settings – also in repositories with their own identity"],
     de: ["Agents committen mit Git-Name und -E-Mail aus deinen Einstellungen – auch in Repos mit eigener Identität"],