From d09bdcd6b9fd6d815d6272a7bc337b410b19b665 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 10:25:38 +0000 Subject: Add uv and a rootless Docker runtime on NixOS hosts uv joins the CLI package list. Docker's daemon is now actually managed on NixOS hosts too, in rootless mode (per-user systemd service, no docker-group root-equivalent access), rather than leaving the runtime entirely externally-managed as before -- the already-installed docker CLI picks it up automatically via DOCKER_HOST. This is a documented, narrow exception to developer-environment's client-only tools policy; kubectl and awscli2 remain unaffected. Archives add-uv-and-docker-runtime and syncs the new container-runtime capability plus the narrowed developer-environment requirement into the main specs. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- .../archive/2026-09-24-add-uv-and-docker-runtime/tasks.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/tasks.md (limited to 'openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/tasks.md') diff --git a/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/tasks.md b/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/tasks.md new file mode 100644 index 0000000..14b6dfc --- /dev/null +++ b/openspec/changes/archive/2026-09-24-add-uv-and-docker-runtime/tasks.md @@ -0,0 +1,14 @@ +## 1. uv CLI tool + +- [x] 1.1 Add `pkgs.uv` to the package list in `modules/home/dev-tools.nix` and verify `nix eval '.#homeConfigurations."tom@linux".config.home.packages'` and `..."tom@darwin"...` both include it. + +## 2. Rootless Docker daemon + +- [x] 2.1 Add `virtualisation.docker.rootless.enable = true;` and `virtualisation.docker.rootless.setSocketVariable = true;` to `modules/nixos/common.nix`, alongside the other unconditional host-level services. +- [x] 2.2 Build a NixOS host's system closure with `hosts/test-vm` visible via the `path:` flake-ref scheme (it's git-untracked): `nix build 'path:/home/tom/desktop-flake#nixosConfigurations.test-vm.config.system.build.toplevel'`, and verify it succeeds. +- [x] 2.3 Inspect the built closure's `systemd.user.services.docker` unit (e.g. via the closure's `etc/systemd/user/docker.service` or an equivalent generated unit file) and verify it runs `dockerd-rootless` with `ConditionUser=!root`, confirming the daemon is wired as a rootless per-user service rather than a root daemon. +- [x] 2.4 On a booted host, after logging in as `tom`, verify `docker run --rm hello-world` succeeds with no manual `DOCKER_HOST` export or other setup — this needs an interactive login session and can't be exercised from this sandbox. + +## 3. Spec sync + +- [x] 3.1 Verify `openspec validate --change add-uv-and-docker-runtime --strict` passes once the above are implemented, confirming both delta specs match the shipped behavior. -- cgit v1.3