Docker CLI in the image (static client for a mounted host socket)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -67,6 +67,14 @@ RUN mkdir -p server/src && echo 'fn main(){}' > server/src/main.rs \
     && mkdir -p /out && cp target/x86_64-unknown-linux-musl/release/codecraft /out/codecraft-linux-x86_64 \
     && cp target/aarch64-unknown-linux-musl/release/codecraft /out/codecraft-linux-aarch64
 
+# --- Docker CLI (static client; the daemon is the host's via the mounted socket) --
+FROM toolchain AS dockercli
+ARG TARGETARCH
+ARG DOCKER_VERSION=29.9.3
+RUN case "$TARGETARCH" in amd64) arch=x86_64 ;; arm64) arch=aarch64 ;; *) echo "unsupported $TARGETARCH" >&2; exit 1 ;; esac \
+    && curl -fsSL "https://download.docker.com/linux/static/stable/$arch/docker-$DOCKER_VERSION.tgz" | tar -xz -C /tmp docker/docker \
+    && install -m 0755 /tmp/docker/docker /docker
+
 # --- runtime ------------------------------------------------------------------
 # Node is included so agents can work on JS projects and run npx-based MCP servers.
 FROM node:22-bookworm-slim
@@ -85,6 +93,8 @@ RUN npm install -g typescript@5 typescript-language-server pyright && npm cache
 COPY --from=server /codecraft /usr/local/bin/codecraft
 COPY --from=web /web/dist /app/web
 COPY --from=cli /out /app/cli
+# Used with a mounted /var/run/docker.sock (see docs/MOVING.md, --docker-sock).
+COPY --from=dockercli /docker /usr/local/bin/docker
 COPY server/ghidra /app/ghidra
 COPY server/resources /app/resources
 # The agent's home lives on the data volume: tools it installs in user space