This is a good question and something I explored a little. I’ll need to do further research and come back on what the best option is. There’s a way to give a docker container access to other docker containers but it can open up permissions more than might be desired here.

Yeah, you can bind mount the host's docker engine with -v /var/run/docker.sock:/var/run/docker.sock ... but yeah, it's potentially dangerous and might also get confusing for the AI agent and/or the user.