Though the user is configured to have the necessary permissions to not require sudo to use docker, it does not work.
The workaround is to manually disconnect, then reconnect the agent. This is because the script is run in the connecting session, then no logout/login is performed.
docker should be usable right away after agent provisioning.
Though we could require users to use sudo, this is likely a major hurdle since users (like evergreen codebase) itself will probably have scripts that run docker without sudo (and as a simple alias won't be enough, then we'd move more and more away from keeping Evergreen simple to use)