Docker-in-Docker guide repro: docker:dind-rootless Sandbox has no Docker socket locally

Summary

I created a minimal Worker + Sandbox repro following the Docker-in-Docker guide:

https://developers.cloudflare.com/sandbox/guides/docker-in-docker/#create-a-docker-enabled-image

The Sandbox container starts and sandbox.exec(...) works, but Docker is not available inside the Sandbox. docker version cannot connect to /var/run/docker.sock. Listing Sandbox background processes shows no startup process from the Dockerfile CMD. Manually starting the documented boot script produces Docker/rootful mount errors and still does not create a usable Docker socket.

Repro

Repository:

https://github.com/ericclemmons/sandbox-dind-repro

Run locally:

pnpm install
pnpm dev

In another terminal:

curl -sS http://localhost:8789/docker-version
curl -sS http://localhost:8789/processes
curl -sS http://localhost:8789/start-docker
curl -sS http://localhost:8789/docker-version

Expected Behavior

Because the Dockerfile matches the guide, the Sandbox container CMD should start Docker and keep it running:

ENTRYPOINT ["/sandbox"]
CMD ["/home/rootless/boot-docker-for-dind.sh"]

Then sandbox.exec("docker version") should show both Docker client and server info.

Actual Behavior

/docker-version:

{
  "success": false,
  "exitCode": 1,
  "stdout": "Client:\n Version:           29.4.1\n API version:       1.54\n Go version:        go1.26.2\n Git commit:        055a478\n Built:             Mon Apr 20 16:31:59 2026\n OS/Arch:           linux/amd64\n Context:           default",
  "stderr": "failed to connect to the docker API at unix:///var/run/docker.sock; check if the path is correct and if the daemon is running: dial unix /var/run/docker.sock: connect: no such file or directory"
}

/processes before manual startup:

{"processes":[]}

/start-docker manually starts /home/rootless/boot-docker-for-dind.sh, but logs include:

Device "nf_tables" does not exist.
modprobe: can't change directory to '/lib/modules': No such file or directory
Device "ip_tables" does not exist.
modprobe: can't change directory to '/lib/modules': No such file or directory
Device "ip6_tables" does not exist.
modprobe: can't change directory to '/lib/modules': No such file or directory
mount: permission denied (are you root?)
Could not mount /sys/kernel/security.
AppArmor detection and --privileged mode might break.
mount: permission denied (are you root?)

After manual startup, /docker-version still fails with missing /var/run/docker.sock.

Environment

• macOS / local Wrangler dev
• @cloudflare/sandbox@0.9.2
• wrangler@4.86.0
• Docker image copies cloudflare/sandbox:0.9.2-musl into docker:dind-rootless

Question

Is the Docker-in-Docker guide expected to work in local Wrangler dev, or only after deploying to Cloudflare Containers? If it should work locally, is there an additional container capability/security setting required for docker:dind-rootless to create the Docker socket?