Mount the instance's Docker socket into the agent container, so builds can run docker commands against the daemon Namespace already runs in the instance — no docker-in-docker required.

Builds then share one daemon with anything else in that instance. Since instances are single-use per build, that is normally fine.