From 096e82ca45a5360b4b2dd084e0fb1a937a227a69 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 11:34:23 +0000 Subject: Switch Docker to rootful after the rootless setup broke in practice Rootless Docker's per-user systemd unit didn't start in a session that was already logged in before a switch, and DOCKER_HOST only reaches freshly-started shells -- both bit Tom immediately (docker run failed against the default rootful socket path, which never existed under rootless). virtualisation.docker.enable = true now runs dockerd as a standard root system service, started at boot; tom joins the docker group for sudo-less access. Trades rootless's isolation guarantee for reliability on a long-lived desktop session. Archives switch-docker-rootful and syncs the container-runtime capability's requirements and Purpose text to match. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- modules/nixos/common.nix | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'modules') diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix index 10f48c6..9ee164b 100644 --- a/modules/nixos/common.nix +++ b/modules/nixos/common.nix @@ -18,7 +18,10 @@ users.users.tom = { isNormalUser = true; - extraGroups = [ "wheel" ]; + extraGroups = [ + "wheel" + "docker" + ]; shell = pkgs.bash; # Fetched once from https://github.com/tomvanderlee.keys and pinned here # as a static literal (not fetched at build time, which would require @@ -69,9 +72,10 @@ openFirewall = true; }; - # Rootless: runs as the user's own systemd user service, not as root, and - # has no docker-group privilege-escalation path. setSocketVariable exports - # DOCKER_HOST automatically so the docker CLI (dev-tools.nix) just works. - virtualisation.docker.rootless.enable = true; - virtualisation.docker.rootless.setSocketVariable = true; + # Rootful: standard system service, starts at boot independent of any + # login session (rootless was tried first but its per-user systemd unit + # didn't reliably start in already-logged-in sessions after a switch). + # tom's docker group membership is root-equivalent access, accepted here + # for reliability over the rootless isolation guarantee. + virtualisation.docker.enable = true; } -- cgit v1.3