docker/: install rootful Docker; gate kind on it

kind never worked reliably against rootless Docker on Kasm, even with the
cgroup delegation from docker-rootless-cgroup/. So install full Docker
where we can, and flip bin/'s kind gate from "rootless is available" to
"a rootful daemon answers" — kind is simply skipped on Kasm now.

docker/install.sh no-ops when a rootless daemon is already running so it
never fights Kasm's setup. It runs before bin/ in bootstrap so the kind
gate can see the daemon it just started. zsh/zshrc re-execs via newgrp
when the account gained the docker group but the live shell predates it.

docker-rootless-cgroup/ keeps its delegation (still useful for
per-container resource limits); only its kind-centric comments change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/install.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+# docker/install.sh — install full (rootful) Docker Engine and let the
+# invoking user talk to it without sudo.
+#
+# What it does:
+#   1. Installs Docker Engine via Docker's official convenience script
+#      (get.docker.com — supports both RHEL- and Debian-family distros and
+#      sets up the upstream package repo). Skipped when `docker` is already
+#      installed.
+#   2. Enables and starts the service (systemd hosts only).
+#   3. Adds the invoking user to the `docker` group so the daemon socket is
+#      usable without sudo. Takes effect at next login.
+#
+# Deliberately no-ops when a rootless Docker daemon is detected (e.g. Kasm
+# ships its own rootless setup) — installing rootful Docker there would fight
+# the existing runtime. See docker-rootless-cgroup/ for the Kasm-side config.
+#
+# Idempotent and safe to re-run. Uses sudo.
+set -eu
+
+say() { printf '%s\n' "$*" >&2; }
+
+# --- skip on rootless-Docker hosts -------------------------------------------
+if command -v docker >/dev/null 2>&1 &&
+   docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'; then
+  say "docker: rootless Docker daemon detected; leaving it alone."
+  exit 0
+fi
+
+# --- 1. install engine -------------------------------------------------------
+if command -v docker >/dev/null 2>&1; then
+  say "docker: engine already installed ($(docker --version 2>/dev/null || echo 'version unknown'))."
+else
+  say "docker: installing Docker Engine via get.docker.com..."
+  tmp="$(mktemp)"
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL https://get.docker.com -o "$tmp"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -qO "$tmp" https://get.docker.com
+  else
+    say "docker: need curl or wget"; exit 1
+  fi
+  sudo sh "$tmp"
+  rm -f "$tmp"
+fi
+
+# --- 2. enable + start the service (systemd only) ----------------------------
+if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
+  sudo systemctl enable --now docker
+else
+  say "docker: no systemd; not managing the service (start dockerd yourself)."
+fi
+
+# --- 3. group membership for the invoking user -------------------------------
+user="$(id -un)"
+if id -nG "$user" | tr ' ' '\n' | grep -qx docker; then
+  say "docker: $user already in the docker group."
+else
+  sudo usermod -aG docker "$user"
+  say "docker: added $user to the docker group."
+  say "  Log out and back in (or run 'newgrp docker') for it to take effect."
+fi