I'm planning to build Docker EE images in dynamic Jenkins agent running in Kubernetes pods and therefore need either

• a Docker image providing both the Jenkins Agent functionality and Docker. Currently I'm using jenkins/jnlp-agent:latest-windows as image to run on a Windows LTSC node pool which seems to provide the Jenkins agent functionality adequately or

• a way to extend jenkins/jnlp-agent:latest-windows so that it allows to run Docker as well. My naive approach

  FROM jenkins/jnlp-agent:latest-windows
  SHELL ["powershell", "-Command", "$ErrorActionPreference = 'SilentlyContinue'; $ProgressPreference = 'SilentlyContinue';"]
  
  USER ContainerAdministrator
  
  COPY install-docker.ps1 .
  RUN ./install-docker.ps1
  RUN Remove-Item install-docker.ps1

  with install-docker.ps1 containing

  Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -ErrorAction Continue
  Install-Module -Name DockerMsftProvider -Repository PSGallery -Force -ErrorAction Continue
  Install-Package -Force -ErrorAction Continue -Name docker -ProviderName DockerMsftProvider

  following https://docs.microsoft.com/en-us/virtualization/windowscontainers/quick-start/set-up-environment?tabs=Windows-Server fails due to

  > Start-Service Docker
  Start-Service : Failed to start service 'Docker Engine (Docker)'.
  At line:1 char:1
  + Start-Service Docker
  + ~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
     ServiceCommandException
      + FullyQualifiedErrorId : StartServiceFailed,Microsoft.PowerShell.Commands.StartServiceCommand
  

  or

• a Docker-in-Docker Container for Docker EE on Windows which exposes a Docker TCP socket and allows the Jenkins agent container to connect to it.

The setup should run on Windows Server 2019 node pools provided by Google Kubernetes Engine. I'm aware that Windows Pools are beta currently.

In case someone has an idea how to get the second approach working, it'd still be necessary to run the setup as user jenkins rather than container administrator in order to increase security.