Docker inside containers

@function
def dind_service(self) -> dagger.Service:
    """Return a Docker daemon running as a sidecar service.

    Wraps the docker:dind entrypoint with DNS forwarding so
    nested Dagger engines can resolve names despite the
    10.87.0.0/16 subnet collision.
    """
    return (
        dag.container()
        .from_(self.pinned(self._dind_engine_image))
        .with_env_variable("DOCKER_TLS_CERTDIR", "")
        .with_env_variable("TINI_SUBREAPER", "")
        .with_new_file(
            "/etc/docker/daemon.json",
            '{"dns": ["172.17.0.1"]}',
        )
        .with_exec([
            "mv",
            "/usr/local/bin/dockerd-entrypoint.sh",
            "/usr/local/bin/dockerd-entrypoint-orig.sh",
        ])
        .with_new_file(
            "/usr/local/bin/dockerd-entrypoint.sh",
            _DIND_DNS_ENTRYPOINT,
            permissions=0o755,
        )
        .with_mounted_cache("/var/lib/docker", dag.cache_volume("dind-docker"))
        .with_exposed_port(2375)
        .as_service(
            use_entrypoint=True,
            insecure_root_capabilities=True,
        )
    )

@function
def dind_container(
    self,
    base: dagger.Container | None = None,
) -> dagger.Container:
    """Return a container with the Docker CLI installed.

    If base is provided, the CLI is added to it.
    Otherwise uses Lib.dind_ubuntu_image.
    """
    if base is None:
        base = dag.container().from_(self.pinned(self._dind_base_image))
    docker_cli = (
        dag.container().from_(self.pinned(self._dind_engine_image)).file("/usr/local/bin/docker")
    )
    return base.with_file("/usr/local/bin/docker", docker_cli)

@function
def dind_with_docker(
    self,
    cmd: str,
    ctr: dagger.Container | None = None,
) -> dagger.Container:
    """Run a shell command inside a container with Docker available.

    Binds a Docker daemon sidecar and sets DOCKER_HOST so the
    Docker CLI in the container talks to the sidecar over TCP.
    """
    if ctr is None:
        ctr = self.dind_container()
    return (
        ctr
        .with_service_binding("docker", self.dind_service())
        .with_env_variable("DOCKER_HOST", "tcp://docker:2375")
        .with_exec(["bash", "-c", cmd])
    )

@function
def dind_run_tests(
    self,
    src: Annotated[
        dagger.Directory,
        DefaultPath("."),
        Ignore(["**",
                "!src/lib/", "!src/ralph.yml", "!sdk/", "!tests/", "!examples/",
                "!dagger.json", "!.daggerignore", "!pyproject.toml",
                "!test-host.sh"]),
    ],
) -> dagger.Container:
    """Run the project test suite inside Docker-in-Docker (dogfooding).

    Builds a test-ready container from the DinD base, installs Python,
    pytest, and the Dagger CLI, mounts the project source, and runs
    ./test-host.sh with dockerd available.
    Source is mounted last so package installs are cached.
    """
    ctr = self.dind_container()
    ctr = (
        ctr
        .with_exec(["apt-get", "update"])
        .with_exec([
            "apt-get", "install", "--yes",
            "curl", "python3", "python3-pip", "python3-venv",
        ])
        .with_exec([
            "pip3", "install", "--break-system-packages",
            "pytest", "pytest-asyncio",
        ])
        .with_exec([
            "bash", "-c",
            "curl -fsSL https://dl.dagger.io/dagger/install.sh"
            " | DAGGER_VERSION=0.20.3 BIN_DIR=/usr/local/bin sh",
        ])
        .with_directory("/work", src)
        .with_workdir("/work")
        .with_directory("/work/.git", dag.directory())
    )
    cmd = (
        "echo '=== dockerd ready ===' && "
        "docker info --format 'Docker: {{.ServerVersion}}' && "
        "echo '=== running test suite ===' && "
        "./test-host.sh"
    )
    return self.dind_with_docker(cmd=cmd, ctr=ctr)

@function
def emacs_container(
    self,
    src: dagger.Directory,
) -> dagger.Container:
    """Return a lightweight container with emacs, git, python, and ruff.

    ~elpa-htmlize~ is installed so ~ox-html~ exports can produce
    syntax-highlighted source blocks.  ~curl~ is there so
    ~export-html-host.sh~ can fetch water.css into the shared
    =.tangle-deps/= cache.
    """
    return (
        dag.container()
        .from_(self.pinned(self._dind_base_image))
        .with_exec(["apt-get", "update"])
        .with_exec([
            "apt-get", "install", "--yes",
            "emacs-nox", "elpa-htmlize", "curl",
            "git", "python3", "python3-pip", "python3-venv",
        ])
        .with_exec([
            "pip3", "install", "--break-system-packages", "ruff",
        ])
        .with_directory("/work", src)
        .with_workdir("/work")
    )

@function
def dind_emacs_container(self) -> dagger.Container:
    """Return a DinD container with emacs, git, python, ruff, and dagger CLI.

    Does NOT mount source — callers add it last so the entire
    tool install chain is cacheable.
    """
    ctr = self.dind_container()
    return (
        ctr
        .with_exec(["apt-get", "update"])
        .with_exec([
            "apt-get", "install", "--yes",
            "curl", "emacs-nox", "git", "python3", "python3-pip", "python3-venv",
        ])
        .with_exec([
            "pip3", "install", "--break-system-packages", "ruff",
        ])
        .with_exec([
            "bash", "-c",
            "curl -fsSL https://dl.dagger.io/dagger/install.sh"
            " | DAGGER_VERSION=0.20.3 BIN_DIR=/usr/local/bin sh",
        ])
    )

@property
def _dind_engine_image(self) -> str:
    return self.dind_image

@property
def _dind_base_image(self) -> str:
    return self.dind_ubuntu_image