Add support for Docker-in-Docker #4970

User Story

I use OpenShell to develop software, and nowadays a lot of that development comes down to building containers, deployment, creatings yaml specs.

I would like to have a setup where my agent can already try to build its own docker containers.

Problem Statement

The problem is in an isolated sandbox docker access would implicitly grant root access, so you can just mount docker.

Impact / Why This Matters

End-To-End Workflows are blocked as long as you do not have docker access in a sandbox.

Proposed Design

I would propose a design to change the runtime to sysbox-runc from https://github.com/nestybox/sysbox .
I already use this in my own sandbox and it works fine (also with gpu support). Sysbox was especially designed to give docker access without giving privileges to root. My hope would be that an options exists where you start openshell with a -dind flag which gives you the optinal runtime.

Acceptance Criteria

• A docker container that can be created and run inside the sandbox, without granting root privileges to the agent

Alternatives Considered

• There is None

Agent Investigation

No response

Checklist

• I've reviewed existing issues and the published docs
• This is a design proposal, not a "please build this" request