1 files changed, 6 insertions, 0 deletions

diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix
index a219850..10f48c6 100644
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -68,4 +68,10 @@
     nssmdns4 = true;
     openFirewall = true;
   };
+
+  # Rootless: runs as the user's own systemd user service, not as root, and
+  # has no docker-group privilege-escalation path. setSocketVariable exports
+  # DOCKER_HOST automatically so the docker CLI (dev-tools.nix) just works.
+  virtualisation.docker.rootless.enable = true;
+  virtualisation.docker.rootless.setSocketVariable = true;
 }