2 files changed, 20 insertions, 11 deletions

diff --git a/modules/home/dev-tools.nix b/modules/home/dev-tools.nix
index 9533ef5..001a78b 100644
--- a/modules/home/dev-tools.nix
+++ b/modules/home/dev-tools.nix
@@ -1,14 +1,17 @@
 { pkgs, lib, ... }:
 {
-  home.packages = (with pkgs; [
-    gh
-    tmux
-    htop
-    yq-go
-    docker
-    docker-compose
-    kubectl
-    awscli2
-    bitwarden-cli
-  ]) ++ lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.claude-code) pkgs.claude-code;
+  home.packages =
+    (with pkgs; [
+      gh
+      tmux
+      htop
+      yq-go
+      docker
+      docker-compose
+      kubectl
+      awscli2
+      bitwarden-cli
+      uv
+    ])
+    ++ lib.optional (lib.meta.availableOn pkgs.stdenv.hostPlatform pkgs.claude-code) pkgs.claude-code;
 }
diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix
index a219850..10f48c6 100644
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -68,4 +68,10 @@
     nssmdns4 = true;
     openFirewall = true;
   };
+
+  # Rootless: runs as the user's own systemd user service, not as root, and
+  # has no docker-group privilege-escalation path. setSocketVariable exports
+  # DOCKER_HOST automatically so the docker CLI (dev-tools.nix) just works.
+  virtualisation.docker.rootless.enable = true;
+  virtualisation.docker.rootless.setSocketVariable = true;
 }