From 096e82ca45a5360b4b2dd084e0fb1a937a227a69 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 11:34:23 +0000 Subject: Switch Docker to rootful after the rootless setup broke in practice Rootless Docker's per-user systemd unit didn't start in a session that was already logged in before a switch, and DOCKER_HOST only reaches freshly-started shells -- both bit Tom immediately (docker run failed against the default rootful socket path, which never existed under rootless). virtualisation.docker.enable = true now runs dockerd as a standard root system service, started at boot; tom joins the docker group for sudo-less access. Trades rootless's isolation guarantee for reliability on a long-lived desktop session. Archives switch-docker-rootful and syncs the container-runtime capability's requirements and Purpose text to match. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- .../specs/container-runtime/spec.md | 25 ++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 openspec/changes/archive/2026-09-24-switch-docker-rootful/specs/container-runtime/spec.md (limited to 'openspec/changes/archive/2026-09-24-switch-docker-rootful/specs') diff --git a/openspec/changes/archive/2026-09-24-switch-docker-rootful/specs/container-runtime/spec.md b/openspec/changes/archive/2026-09-24-switch-docker-rootful/specs/container-runtime/spec.md new file mode 100644 index 0000000..7edb25d --- /dev/null +++ b/openspec/changes/archive/2026-09-24-switch-docker-rootful/specs/container-runtime/spec.md @@ -0,0 +1,25 @@ +## REMOVED Requirements + +### Requirement: A rootless Docker daemon runs on every NixOS host +**Reason**: Switched to a standard rootful Docker daemon — the rootless per-user systemd service didn't reliably start in already-logged-in sessions, causing real `docker` CLI failures in practice. +**Migration**: Replaced by "A Docker daemon runs on every NixOS host" below. + +### Requirement: The Docker CLI connects to the rootless daemon without manual configuration +**Reason**: Rootful Docker uses the standard system-wide socket path and `docker`-group membership instead of a per-session `DOCKER_HOST` export, so this requirement no longer applies. +**Migration**: Replaced by "The user account has access to the Docker socket" below. + +## ADDED Requirements + +### Requirement: A Docker daemon runs on every NixOS host +Every NixOS host built from this flake's shared system module SHALL run a Docker daemon as a system-level service, started at boot rather than tied to a user login session, without requiring per-host opt-in. + +#### Scenario: Daemon available after boot +- **WHEN** a NixOS host built from this flake's shared system module finishes booting +- **THEN** a Docker daemon is running as a system service, independent of whether any user has logged in + +### Requirement: The user account has access to the Docker socket +The user account provisioned on a NixOS host built from this flake's shared system module SHALL be a member of the group that grants access to the Docker daemon's socket, so Docker CLI commands work without `sudo` or manual connection configuration. + +#### Scenario: Docker command works without sudo +- **WHEN** the provisioned user runs a `docker` CLI command on a NixOS host built from this flake's shared system module +- **THEN** the command reaches the daemon and executes, without requiring `sudo` or any manually exported connection configuration -- cgit v1.3