Auto-fallback to sg docker when daemon access is denied

scripts/run_docker.sh

@@ -11,6 +11,34 @@ else
   exit 1
 fi
 
+has_docker_group() {
+  id -nG | tr ' ' '\n' | grep -qx docker
+}
+
+can_access_docker_daemon() {
+  docker info >/dev/null 2>&1
+}
+
+if ! can_access_docker_daemon; then
+  if [[ "${RUN_DOCKER_SG_FALLBACK:-0}" != "1" ]] \
+    && command -v sg >/dev/null 2>&1 \
+    && has_docker_group; then
+    printf -v REEXEC_CMD '%q ' "$0" "$@"
+    exec sg docker -c "RUN_DOCKER_SG_FALLBACK=1 ${REEXEC_CMD}"
+  fi
+
+  if has_docker_group; then
+    echo "ERROR: cannot access Docker daemon from this shell." >&2
+    echo "Hint: run 'newgrp docker' in this shell, or rerun with:" >&2
+    echo "  sg docker -c '$0 ${*:-}'" >&2
+  else
+    echo "ERROR: user '$(id -un)' is not in docker group." >&2
+    echo "Run once as sudo, then re-login:" >&2
+    echo "  sudo usermod -aG docker $(id -un)" >&2
+  fi
+  exit 1
+fi
+
 if docker compose version >/dev/null 2>&1; then
   COMPOSE=(docker compose)
 elif command -v docker-compose >/dev/null 2>&1; then