What problem does it solve? Workloads that need their own container runtime cannot run Docker inside a standard sandbox, and choosing the wrong isolation mode (privileged runc) exposes the host. This Skill explains how to enable Docker-in-Docker safely through sandbox templates. ## Core Features & Use Cases - Runtime selection guidance: Compares kata (Firecracker microVM) versus privileged runc for running dockerd, with plain-language security consequences. - Template discovery: Uses abx templates and abx envs commands to find which templates carry dind support and which template an env currently uses. - Registry access: Covers internal registry mirrors, image-pull secrets, and running docker login inside the sandbox. - Use Case: An agent needs to build images and run docker compose up inside its sandbox; this Skill walks through picking a kata-based template, creating the sandbox with a longer timeout, and verifying with docker version. ## Quick Start Ask the agent to create a sandbox on a dind-enabled kata template and run docker version inside it to confirm the daemon is up.
