Switch Docker to rootful after the rootless setup broke in practice

Rootless Docker's per-user systemd unit didn't start in a session
that was already logged in before a switch, and DOCKER_HOST only
reaches freshly-started shells -- both bit Tom immediately (docker
run failed against the default rootful socket path, which never
existed under rootless). virtualisation.docker.enable = true now
runs dockerd as a standard root system service, started at boot;
tom joins the docker group for sudo-less access. Trades rootless's
isolation guarantee for reliability on a long-lived desktop session.

Archives switch-docker-rootful and syncs the container-runtime
capability's requirements and Purpose text to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB

1 files changed, 10 insertions, 0 deletions

diff --git a/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md b/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md
new file mode 100644
index 0000000..f73e8d0
--- /dev/null
+++ b/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md
@@ -0,0 +1,10 @@
+## 1. Switch to rootful Docker
+
+- [x] 1.1 In `modules/nixos/common.nix`, replace `virtualisation.docker.rootless.enable`/`setSocketVariable` with `virtualisation.docker.enable = true;`.
+- [x] 1.2 Add `"docker"` to `users.users.tom.extraGroups` in `modules/nixos/common.nix` (alongside `"wheel"`).
+- [x] 1.3 Build a NixOS host's system closure with `hosts/test-vm` visible via the `path:` flake-ref scheme: `nix build 'path:/home/tom/desktop-flake#nixosConfigurations.test-vm.config.system.build.toplevel'`, and verify it succeeds.
+- [x] 1.4 Inspect the built closure's Docker systemd unit (system-level `docker.service`, not a user unit this time) and verify it's a root-run system service, and verify `tom`'s configured groups include `docker`.
+
+## 2. Spec sync
+
+- [x] 2.1 Verify `openspec validate --change switch-docker-rootful --strict` passes, confirming the delta spec matches the shipped behavior.