Don't install docker in docker (#2821)

buildkite/docker/debian10/Dockerfile

diff --git a/buildkite/docker/debian10/Dockerfile b/buildkite/docker/debian10/Dockerfile
index d7f9f04..a8ccabe 100644
--- a/buildkite/docker/debian10/Dockerfile
+++ b/buildkite/docker/debian10/Dockerfile
@@ -72,15 +72,6 @@
     apt-get update -y && apt-get install google-cloud-cli -y && \
     rm -rf /var/lib/apt/lists/*
 
-### Docker (for legacy rbe_autoconfig)
-RUN apt-get -y update && \
-    apt-get -y install apt-transport-https ca-certificates && \
-    curl -sSL https://download.docker.com/linux/debian/gpg | apt-key add - && \
-    add-apt-repository "deb [arch=$BUILDARCH] https://download.docker.com/linux/debian $(lsb_release -cs) stable" && \
-    apt-get -y update && \
-    apt-get -y install docker-ce && \
-    rm -rf /var/lib/apt/lists/*
-
 # Bazelisk
 RUN LATEST_BAZELISK=$(curl -sSI https://github.com/bazelbuild/bazelisk/releases/latest | grep -i '^location: ' | sed 's|.*/||' | sed $'s/\r//') && \
     curl -Lo /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/${LATEST_BAZELISK}/bazelisk-linux-${BUILDARCH} && \

buildkite/docker/debian12/Dockerfile

diff --git a/buildkite/docker/debian12/Dockerfile b/buildkite/docker/debian12/Dockerfile
index 429594f..150c281 100644
--- a/buildkite/docker/debian12/Dockerfile
+++ b/buildkite/docker/debian12/Dockerfile
@@ -61,15 +61,6 @@
     apt-get update -y && apt-get install google-cloud-cli -y && \
     rm -rf /var/lib/apt/lists/*
 
-### Docker (for legacy rbe_autoconfig)
-RUN apt-get -y update && \
-    apt-get -y install apt-transport-https ca-certificates && \
-    curl -sSL https://download.docker.com/linux/debian/gpg | apt-key add - && \
-    add-apt-repository "deb [arch=$TARGETARCH] https://download.docker.com/linux/debian $(lsb_release -cs) stable" && \
-    apt-get -y update && \
-    apt-get -y install docker-ce && \
-    rm -rf /var/lib/apt/lists/*
-
 # Bazelisk
 COPY --from=tools --chmod=0755 bazelisk-linux-${TARGETARCH} /usr/local/bin/bazel
 

buildkite/docker/debian13/Dockerfile

diff --git a/buildkite/docker/debian13/Dockerfile b/buildkite/docker/debian13/Dockerfile
index 17cc0d9..404676f 100644
--- a/buildkite/docker/debian13/Dockerfile
+++ b/buildkite/docker/debian13/Dockerfile
@@ -61,15 +61,6 @@
     apt-get update -y && apt-get install google-cloud-cli -y && \
     rm -rf /var/lib/apt/lists/*
 
-### Docker (for legacy rbe_autoconfig)
-RUN apt-get -y update && \
-    apt-get -y install apt-transport-https ca-certificates && \
-    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg && \
-    echo "deb [arch=$TARGETARCH signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null && \
-    apt-get -y update && \
-    apt-get -y install docker-ce && \
-    rm -rf /var/lib/apt/lists/*
-
 # Bazelisk
 COPY --from=tools --chmod=0755 bazelisk-linux-${TARGETARCH} /usr/local/bin/bazel
 

buildkite/docker/rockylinux8/Dockerfile

diff --git a/buildkite/docker/rockylinux8/Dockerfile b/buildkite/docker/rockylinux8/Dockerfile
index b2c1efa..77848a8 100644
--- a/buildkite/docker/rockylinux8/Dockerfile
+++ b/buildkite/docker/rockylinux8/Dockerfile
@@ -41,11 +41,6 @@
 # Allow using sudo inside the container.
 RUN echo "ALL ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
 
-RUN dnf -y install dnf-utils && \
-    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo && \
-    dnf -y install docker-ce docker-ce-cli containerd.io && \
-    dnf clean all
-
 # Ensure that Bazel can use its beloved ISO-8859-1 locale.
 RUN localedef -i en_US -f ISO-8859-1 en_US.ISO-8859-1
 

buildkite/docker/ubuntu2404/Dockerfile

diff --git a/buildkite/docker/ubuntu2404/Dockerfile b/buildkite/docker/ubuntu2404/Dockerfile
index 2499802..6b21e19 100644
--- a/buildkite/docker/ubuntu2404/Dockerfile
+++ b/buildkite/docker/ubuntu2404/Dockerfile
@@ -16,7 +16,6 @@
     clang-tools \
     coreutils \
     curl \
-    docker.io \
     dnsutils \
     ed \
     expect \

buildkite/setup-docker.sh

diff --git a/buildkite/setup-docker.sh b/buildkite/setup-docker.sh
index 2d8acf0..4be0076 100755
--- a/buildkite/setup-docker.sh
+++ b/buildkite/setup-docker.sh
@@ -102,34 +102,6 @@
   sed -i 's/^::1 .*/::1 localhost ip6-localhost ip6-loopback/' /etc/hosts
 }
 
-### Install Docker.
-{
-  apt-get -y install apt-transport-https ca-certificates
-
-  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
-  echo \
-      "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
-      $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
-
-  apt-get -y update
-  apt-get -y install docker-ce docker-ce-cli containerd.io
-
-  # Allow everyone access to the Docker socket. Usually this would be insane from a security point
-  # of view, but these are untrusted throw-away machines anyway, so the risk is acceptable.
-  mkdir /etc/systemd/system/docker.socket.d
-  cat > /etc/systemd/system/docker.socket.d/override.conf <<'EOF'
-[Socket]
-SocketMode=0666
-EOF
-
-  # Disable the Docker service, as the startup script has to mount /var/lib/docker first.
-  systemctl disable docker
-  systemctl stop docker
-
-  # Add buildkite-agent to the docker group to grant it permissions to the Docker socket
-  usermod -aG docker buildkite-agent
-}
-
 ## Add our minimum uptime enforcer.
 {
   cat > /etc/systemd/system/minimum-uptime.service <<'EOF'