Switch Docker to rootful after the rootless setup broke in practice

Rootless Docker's per-user systemd unit didn't start in a session
that was already logged in before a switch, and DOCKER_HOST only
reaches freshly-started shells -- both bit Tom immediately (docker
run failed against the default rootful socket path, which never
existed under rootless). virtualisation.docker.enable = true now
runs dockerd as a standard root system service, started at boot;
tom joins the docker group for sudo-less access. Trades rootless's
isolation guarantee for reliability on a long-lived desktop session.

Archives switch-docker-rootful and syncs the container-runtime
capability's requirements and Purpose text to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB

1 files changed, 10 insertions, 10 deletions

diff --git a/openspec/specs/container-runtime/spec.md b/openspec/specs/container-runtime/spec.md
index 0b07f92..a49f94f 100644
--- a/openspec/specs/container-runtime/spec.md
+++ b/openspec/specs/container-runtime/spec.md
@@ -2,20 +2,20 @@
 
 ## Purpose
 
-Provides a working, unprivileged Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step.
+Provides a working Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step.
 
 ## Requirements
 
-### Requirement: A rootless Docker daemon runs on every NixOS host
-Every NixOS host built from this flake's shared system module SHALL run a Docker daemon in rootless mode (as the user's own account, not as root), without requiring per-host opt-in.
+### Requirement: A Docker daemon runs on every NixOS host
+Every NixOS host built from this flake's shared system module SHALL run a Docker daemon as a system-level service, started at boot rather than tied to a user login session, without requiring per-host opt-in.
 
 #### Scenario: Daemon available after boot
-- **WHEN** a NixOS host built from this flake's shared system module finishes booting and the user logs in
-- **THEN** a Docker daemon is running under that user's own account, not as root
+- **WHEN** a NixOS host built from this flake's shared system module finishes booting
+- **THEN** a Docker daemon is running as a system service, independent of whether any user has logged in
 
-### Requirement: The Docker CLI connects to the rootless daemon without manual configuration
-A user on a NixOS host built from this flake's shared system module SHALL be able to run Docker CLI commands (e.g. `docker run`, `docker build`) against the rootless daemon without manually setting `DOCKER_HOST` or other connection configuration.
+### Requirement: The user account has access to the Docker socket
+The user account provisioned on a NixOS host built from this flake's shared system module SHALL be a member of the group that grants access to the Docker daemon's socket, so Docker CLI commands work without `sudo` or manual connection configuration.
 
-#### Scenario: Docker command works out of the box
-- **WHEN** a user runs a `docker` CLI command on a NixOS host built from this flake's shared system module
-- **THEN** the command reaches the rootless daemon and executes, without the user having exported `DOCKER_HOST` or written any Docker connection config themselves
+#### Scenario: Docker command works without sudo
+- **WHEN** the provisioned user runs a `docker` CLI command on a NixOS host built from this flake's shared system module
+- **THEN** the command reaches the daemon and executes, without requiring `sudo` or any manually exported connection configuration