2 files changed, 27 insertions, 2 deletions

diff --git a/openspec/specs/container-runtime/spec.md b/openspec/specs/container-runtime/spec.md
new file mode 100644
index 0000000..0b07f92
--- /dev/null
+++ b/openspec/specs/container-runtime/spec.md
@@ -0,0 +1,21 @@
+# container-runtime Specification
+
+## Purpose
+
+Provides a working, unprivileged Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step.
+
+## Requirements
+
+### Requirement: A rootless Docker daemon runs on every NixOS host
+Every NixOS host built from this flake's shared system module SHALL run a Docker daemon in rootless mode (as the user's own account, not as root), without requiring per-host opt-in.
+
+#### Scenario: Daemon available after boot
+- **WHEN** a NixOS host built from this flake's shared system module finishes booting and the user logs in
+- **THEN** a Docker daemon is running under that user's own account, not as root
+
+### Requirement: The Docker CLI connects to the rootless daemon without manual configuration
+A user on a NixOS host built from this flake's shared system module SHALL be able to run Docker CLI commands (e.g. `docker run`, `docker build`) against the rootless daemon without manually setting `DOCKER_HOST` or other connection configuration.
+
+#### Scenario: Docker command works out of the box
+- **WHEN** a user runs a `docker` CLI command on a NixOS host built from this flake's shared system module
+- **THEN** the command reaches the rootless daemon and executes, without the user having exported `DOCKER_HOST` or written any Docker connection config themselves
diff --git a/openspec/specs/developer-environment/spec.md b/openspec/specs/developer-environment/spec.md
index 374f098..bcdc3e4 100644
--- a/openspec/specs/developer-environment/spec.md
+++ b/openspec/specs/developer-environment/spec.md
@@ -12,12 +12,16 @@ The shared home-manager profile SHALL include the user's evidenced most-used CLI
 - **THEN** the provisioned developer CLI tools are available on `PATH` without any additional manual installation step
 
 ### Requirement: Container and cloud tools are client-only
-Container and cloud-related packages provisioned by this capability SHALL provide client/CLI functionality only; they SHALL NOT attempt to provide or manage the underlying runtime or service (e.g. a container engine or cloud account).
+Container and cloud-related packages provisioned by this capability SHALL provide client/CLI functionality only; they SHALL NOT attempt to provide or manage the underlying runtime or service (e.g. a Kubernetes cluster or cloud account), with one exception: Docker's runtime is managed on NixOS hosts by the separate `container-runtime` capability. Outside of NixOS hosts, and for every other tool (`kubectl`, `awscli2`), no corresponding runtime or account is installed or managed.
 
 #### Scenario: No runtime is installed or managed
-- **WHEN** a container or cloud CLI tool is provisioned by the shared home profile
+- **WHEN** a container or cloud CLI tool other than Docker is provisioned by the shared home profile
 - **THEN** no corresponding daemon, virtual machine, or account configuration is installed or managed by this capability — the tool simply connects to whatever runtime or account is already configured on the system
 
+#### Scenario: Docker's runtime is the documented exception on NixOS
+- **WHEN** the Docker CLI is provisioned by the shared home profile on a NixOS host built from this flake's shared system module
+- **THEN** a Docker runtime is available via the separate `container-runtime` capability, rather than being left entirely unmanaged
+
 ### Requirement: Shell and prompt configuration defers to the user's personal dotfiles
 Where the user's personal dotfiles repository already owns a piece of shell or prompt configuration, the shared home profile SHALL provide only the underlying package, not a competing managed configuration for that same file.