diff options
Diffstat (limited to 'openspec/specs/container-runtime')
| -rw-r--r-- | openspec/specs/container-runtime/spec.md | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/openspec/specs/container-runtime/spec.md b/openspec/specs/container-runtime/spec.md index 0b07f92..a49f94f 100644 --- a/openspec/specs/container-runtime/spec.md +++ b/openspec/specs/container-runtime/spec.md | |||
| @@ -2,20 +2,20 @@ | |||
| 2 | 2 | ||
| 3 | ## Purpose | 3 | ## Purpose |
| 4 | 4 | ||
| 5 | Provides a working, unprivileged Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step. | 5 | Provides a working Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step. |
| 6 | 6 | ||
| 7 | ## Requirements | 7 | ## Requirements |
| 8 | 8 | ||
| 9 | ### Requirement: A rootless Docker daemon runs on every NixOS host | 9 | ### Requirement: A Docker daemon runs on every NixOS host |
| 10 | Every NixOS host built from this flake's shared system module SHALL run a Docker daemon in rootless mode (as the user's own account, not as root), without requiring per-host opt-in. | 10 | Every NixOS host built from this flake's shared system module SHALL run a Docker daemon as a system-level service, started at boot rather than tied to a user login session, without requiring per-host opt-in. |
| 11 | 11 | ||
| 12 | #### Scenario: Daemon available after boot | 12 | #### Scenario: Daemon available after boot |
| 13 | - **WHEN** a NixOS host built from this flake's shared system module finishes booting and the user logs in | 13 | - **WHEN** a NixOS host built from this flake's shared system module finishes booting |
| 14 | - **THEN** a Docker daemon is running under that user's own account, not as root | 14 | - **THEN** a Docker daemon is running as a system service, independent of whether any user has logged in |
| 15 | 15 | ||
| 16 | ### Requirement: The Docker CLI connects to the rootless daemon without manual configuration | 16 | ### Requirement: The user account has access to the Docker socket |
| 17 | A user on a NixOS host built from this flake's shared system module SHALL be able to run Docker CLI commands (e.g. `docker run`, `docker build`) against the rootless daemon without manually setting `DOCKER_HOST` or other connection configuration. | 17 | The user account provisioned on a NixOS host built from this flake's shared system module SHALL be a member of the group that grants access to the Docker daemon's socket, so Docker CLI commands work without `sudo` or manual connection configuration. |
| 18 | 18 | ||
| 19 | #### Scenario: Docker command works out of the box | 19 | #### Scenario: Docker command works without sudo |
| 20 | - **WHEN** a user runs a `docker` CLI command on a NixOS host built from this flake's shared system module | 20 | - **WHEN** the provisioned user runs a `docker` CLI command on a NixOS host built from this flake's shared system module |
| 21 | - **THEN** the command reaches the rootless daemon and executes, without the user having exported `DOCKER_HOST` or written any Docker connection config themselves | 21 | - **THEN** the command reaches the daemon and executes, without requiring `sudo` or any manually exported connection configuration |