From d09bdcd6b9fd6d815d6272a7bc337b410b19b665 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 10:25:38 +0000 Subject: Add uv and a rootless Docker runtime on NixOS hosts uv joins the CLI package list. Docker's daemon is now actually managed on NixOS hosts too, in rootless mode (per-user systemd service, no docker-group root-equivalent access), rather than leaving the runtime entirely externally-managed as before -- the already-installed docker CLI picks it up automatically via DOCKER_HOST. This is a documented, narrow exception to developer-environment's client-only tools policy; kubectl and awscli2 remain unaffected. Archives add-uv-and-docker-runtime and syncs the new container-runtime capability plus the narrowed developer-environment requirement into the main specs. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- modules/nixos/common.nix | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'modules/nixos/common.nix') diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix index a219850..10f48c6 100644 --- a/modules/nixos/common.nix +++ b/modules/nixos/common.nix @@ -68,4 +68,10 @@ nssmdns4 = true; openFirewall = true; }; + + # Rootless: runs as the user's own systemd user service, not as root, and + # has no docker-group privilege-escalation path. setSocketVariable exports + # DOCKER_HOST automatically so the docker CLI (dev-tools.nix) just works. + virtualisation.docker.rootless.enable = true; + virtualisation.docker.rootless.setSocketVariable = true; } -- cgit v1.3