Add rootless Docker (docker-in-docker) to fx image

Install rootless extras (docker-ce-rootless-extras, uidmap,
dbus-user-session, fuse-overlayfs, slirp4netns) on top of the Docker CE
already in the base, preset DOCKER_HOST/XDG_RUNTIME_DIR, and ship a
dockerd-rootless-start helper to bring up the daemon as the coder user.

Author: f3l1x

README.md

@@ -47,6 +47,18 @@ So you’re replacing the plain enterprise base with the same foundation plus ou
 - **Claude** and **OpenCode** installers (best-effort copy to `/usr/local/bin` when present).
 - **npm globals:** `@openai/codex`, `@github/copilot`.
 - **Chrome libraries** plus **agent-browser** (installs its Chromium).
+- **Rootless Docker** (docker-in-docker): Docker CE from the base plus rootless extras (`uidmap`, `fuse-overlayfs`, `slirp4netns`). Run `dockerd-rootless-start` to bring up the daemon as the `coder` user.
+
+### Rootless Docker
+
+The image can run Docker-in-Docker without privileged root. Start the daemon inside the workspace:
+
+```bash
+dockerd-rootless-start
+docker run --rm hello-world
+```
+
+`DOCKER_HOST` and `XDG_RUNTIME_DIR` are preset for login shells, so the CLI talks to the rootless daemon automatically. The host must permit nested user namespaces — in a Coder Terraform template, run the workspace container with `privileged = true` (or the equivalent `--userns` setup), and call `dockerd-rootless-start` from `startup_script` to have Docker ready on boot.
 
 ## Development
 

fx/Dockerfile

@@ -8,8 +8,15 @@ ENV GOROOT=/usr/local/go
 ENV GOPATH=/home/coder/go
 ENV PATH=$GOROOT/bin:$GOPATH/bin:$PATH
 
+# Rootless Docker (docker-in-docker without privileged root)
+ENV XDG_RUNTIME_DIR=/run/user/1000
+ENV DOCKER_HOST=unix:///run/user/1000/docker.sock
+
 USER root
 
+# Helper to bring up the rootless Docker daemon at workspace start
+COPY --chmod=0755 dockerd-rootless-start.sh /usr/local/bin/dockerd-rootless-start
+
 RUN \
     # REPOS ####################################################################
     # Add all package repos first, then do a single apt-get update
@@ -39,6 +46,8 @@ RUN \
         php8.5-zip php8.5-bcmath php8.5-apcu php8.5-imagick \
         # Python
         python3 python3-pip python3-venv \
+        # Rootless Docker (docker-ce is already in the base image)
+        docker-ce-rootless-extras uidmap dbus-user-session fuse-overlayfs slirp4netns \
         # GitHub CLI
         gh \
         # Chrome libs (agent-browser)
@@ -90,6 +99,10 @@ RUN \
     echo 'export BUN_INSTALL="${BUN_INSTALL:-/usr/local}"' >> /etc/profile && \
     echo '[ -d "$DENO_INSTALL/bin" ] && export PATH="$DENO_INSTALL/bin:$PATH"' >> /etc/profile && \
     echo '[ -d "$BUN_INSTALL/bin" ] && export PATH="$BUN_INSTALL/bin:$PATH"' >> /etc/profile && \
+    echo '' >> /etc/profile && \
+    echo '# Rootless Docker' >> /etc/profile && \
+    echo 'export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"' >> /etc/profile && \
+    echo 'export DOCKER_HOST="unix://${XDG_RUNTIME_DIR}/docker.sock"' >> /etc/profile && \
     # OWNERSHIP (coder can upgrade tools) ######################################
     chown -R coder:coder /home/coder/.local /home/coder/.opencode /home/coder/go 2>/dev/null || true && \
     # CLEANUP ###################################################################

fx/dockerd-rootless-start.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Start the rootless Docker daemon for the current (non-root) user.
+#
+# Docker CE is already present in the image; this brings up dockerd in
+# rootless mode so workspaces can run Docker-in-Docker without privileged
+# root. Run it once after the container/workspace starts:
+#
+#     dockerd-rootless-start
+#     docker run --rm hello-world
+#
+# Note: the host must allow user namespaces. In Coder, run the container
+# with --userns-host or the equivalent template option.
+set -euo pipefail
+
+uid="$(id -u)"
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/${uid}}"
+export DOCKER_HOST="unix://${XDG_RUNTIME_DIR}/docker.sock"
+
+# /run/user/<uid> lives on tmpfs and is recreated on every container start.
+if [ ! -d "$XDG_RUNTIME_DIR" ]; then
+    sudo install -d -m 0700 -o "$uid" -g "$(id -g)" "$XDG_RUNTIME_DIR"
+fi
+
+if docker info >/dev/null 2>&1; then
+    echo "rootless dockerd already running at ${DOCKER_HOST}"
+    exit 0
+fi
+
+echo "starting rootless dockerd ..."
+nohup dockerd-rootless.sh >/tmp/dockerd-rootless.log 2>&1 &
+
+for _ in $(seq 1 30); do
+    if docker info >/dev/null 2>&1; then
+        echo "rootless dockerd ready at ${DOCKER_HOST}"
+        exit 0
+    fi
+    sleep 1
+done
+
+echo "dockerd did not become ready in time; see /tmp/dockerd-rootless.log" >&2
+exit 1