From 096e82ca45a5360b4b2dd084e0fb1a937a227a69 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 11:34:23 +0000 Subject: Switch Docker to rootful after the rootless setup broke in practice Rootless Docker's per-user systemd unit didn't start in a session that was already logged in before a switch, and DOCKER_HOST only reaches freshly-started shells -- both bit Tom immediately (docker run failed against the default rootful socket path, which never existed under rootless). virtualisation.docker.enable = true now runs dockerd as a standard root system service, started at boot; tom joins the docker group for sudo-less access. Trades rootless's isolation guarantee for reliability on a long-lived desktop session. Archives switch-docker-rootful and syncs the container-runtime capability's requirements and Purpose text to match. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- .../changes/archive/2026-09-24-switch-docker-rootful/tasks.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md (limited to 'openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md') diff --git a/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md b/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md new file mode 100644 index 0000000..f73e8d0 --- /dev/null +++ b/openspec/changes/archive/2026-09-24-switch-docker-rootful/tasks.md @@ -0,0 +1,10 @@ +## 1. Switch to rootful Docker + +- [x] 1.1 In `modules/nixos/common.nix`, replace `virtualisation.docker.rootless.enable`/`setSocketVariable` with `virtualisation.docker.enable = true;`. +- [x] 1.2 Add `"docker"` to `users.users.tom.extraGroups` in `modules/nixos/common.nix` (alongside `"wheel"`). +- [x] 1.3 Build a NixOS host's system closure with `hosts/test-vm` visible via the `path:` flake-ref scheme: `nix build 'path:/home/tom/desktop-flake#nixosConfigurations.test-vm.config.system.build.toplevel'`, and verify it succeeds. +- [x] 1.4 Inspect the built closure's Docker systemd unit (system-level `docker.service`, not a user unit this time) and verify it's a root-run system service, and verify `tom`'s configured groups include `docker`. + +## 2. Spec sync + +- [x] 2.1 Verify `openspec validate --change switch-docker-rootful --strict` passes, confirming the delta spec matches the shipped behavior. -- cgit v1.3