From d09bdcd6b9fd6d815d6272a7bc337b410b19b665 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 10:25:38 +0000 Subject: Add uv and a rootless Docker runtime on NixOS hosts uv joins the CLI package list. Docker's daemon is now actually managed on NixOS hosts too, in rootless mode (per-user systemd service, no docker-group root-equivalent access), rather than leaving the runtime entirely externally-managed as before -- the already-installed docker CLI picks it up automatically via DOCKER_HOST. This is a documented, narrow exception to developer-environment's client-only tools policy; kubectl and awscli2 remain unaffected. Archives add-uv-and-docker-runtime and syncs the new container-runtime capability plus the narrowed developer-environment requirement into the main specs. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- .../specs/container-runtime/spec.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/specs/container-runtime/spec.md (limited to 'openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/specs/container-runtime') diff --git a/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/specs/container-runtime/spec.md b/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/specs/container-runtime/spec.md new file mode 100644 index 0000000..e0565c6 --- /dev/null +++ b/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/specs/container-runtime/spec.md @@ -0,0 +1,19 @@ +## Purpose + +Provides a working, unprivileged Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step. + +## ADDED Requirements + +### Requirement: A rootless Docker daemon runs on every NixOS host +Every NixOS host built from this flake's shared system module SHALL run a Docker daemon in rootless mode (as the user's own account, not as root), without requiring per-host opt-in. + +#### Scenario: Daemon available after boot +- **WHEN** a NixOS host built from this flake's shared system module finishes booting and the user logs in +- **THEN** a Docker daemon is running under that user's own account, not as root + +### Requirement: The Docker CLI connects to the rootless daemon without manual configuration +A user on a NixOS host built from this flake's shared system module SHALL be able to run Docker CLI commands (e.g. `docker run`, `docker build`) against the rootless daemon without manually setting `DOCKER_HOST` or other connection configuration. + +#### Scenario: Docker command works out of the box +- **WHEN** a user runs a `docker` CLI command on a NixOS host built from this flake's shared system module +- **THEN** the command reaches the rootless daemon and executes, without the user having exported `DOCKER_HOST` or written any Docker connection config themselves -- cgit v1.3