From 096e82ca45a5360b4b2dd084e0fb1a937a227a69 Mon Sep 17 00:00:00 2001 From: Tom van der Lee Date: Thu, 24 Sep 2026 11:34:23 +0000 Subject: Switch Docker to rootful after the rootless setup broke in practice Rootless Docker's per-user systemd unit didn't start in a session that was already logged in before a switch, and DOCKER_HOST only reaches freshly-started shells -- both bit Tom immediately (docker run failed against the default rootful socket path, which never existed under rootless). virtualisation.docker.enable = true now runs dockerd as a standard root system service, started at boot; tom joins the docker group for sudo-less access. Trades rootless's isolation guarantee for reliability on a long-lived desktop session. Archives switch-docker-rootful and syncs the container-runtime capability's requirements and Purpose text to match. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01HngxrvqEzq8oBEBDtrYJyB --- openspec/specs/container-runtime/spec.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'openspec/specs/container-runtime/spec.md') diff --git a/openspec/specs/container-runtime/spec.md b/openspec/specs/container-runtime/spec.md index 0b07f92..a49f94f 100644 --- a/openspec/specs/container-runtime/spec.md +++ b/openspec/specs/container-runtime/spec.md @@ -2,20 +2,20 @@ ## Purpose -Provides a working, unprivileged Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step. +Provides a working Docker container runtime on every NixOS host built from this flake, so the already-provisioned Docker CLI tooling has a daemon to talk to without a separately-managed installation step. ## Requirements -### Requirement: A rootless Docker daemon runs on every NixOS host -Every NixOS host built from this flake's shared system module SHALL run a Docker daemon in rootless mode (as the user's own account, not as root), without requiring per-host opt-in. +### Requirement: A Docker daemon runs on every NixOS host +Every NixOS host built from this flake's shared system module SHALL run a Docker daemon as a system-level service, started at boot rather than tied to a user login session, without requiring per-host opt-in. #### Scenario: Daemon available after boot -- **WHEN** a NixOS host built from this flake's shared system module finishes booting and the user logs in -- **THEN** a Docker daemon is running under that user's own account, not as root +- **WHEN** a NixOS host built from this flake's shared system module finishes booting +- **THEN** a Docker daemon is running as a system service, independent of whether any user has logged in -### Requirement: The Docker CLI connects to the rootless daemon without manual configuration -A user on a NixOS host built from this flake's shared system module SHALL be able to run Docker CLI commands (e.g. `docker run`, `docker build`) against the rootless daemon without manually setting `DOCKER_HOST` or other connection configuration. +### Requirement: The user account has access to the Docker socket +The user account provisioned on a NixOS host built from this flake's shared system module SHALL be a member of the group that grants access to the Docker daemon's socket, so Docker CLI commands work without `sudo` or manual connection configuration. -#### Scenario: Docker command works out of the box -- **WHEN** a user runs a `docker` CLI command on a NixOS host built from this flake's shared system module -- **THEN** the command reaches the rootless daemon and executes, without the user having exported `DOCKER_HOST` or written any Docker connection config themselves +#### Scenario: Docker command works without sudo +- **WHEN** the provisioned user runs a `docker` CLI command on a NixOS host built from this flake's shared system module +- **THEN** the command reaches the daemon and executes, without requiring `sudo` or any manually exported connection configuration -- cgit v1.3