From be517456a95e1c4c9801d892934e7a8647a632ff Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Mon, 12 Oct 2026 09:46:53 -0500 Subject: [PATCH] decisions: 106, Q103 agreed, rootless daemon beside the rootful one (I1-2) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 29 +++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 8a834d7cd..19d9058a4 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -2345,3 +2345,32 @@ which stay with him. Each item names who decided it and what happened. - For decision 96, I1's direction is ratified and M1 is approved (decision 104). I1-2 to I1-4 are open. When T3 Mos retires is still Jason's call, after M3. +106. **Q103 agreed: a rootless daemon beside the rootful one, I1-2 + (2026-10-12).** Jason, relayed by Mos (sage-0075, recorded in + jason-master-restart DECISIONS.md): "Q103: agreed. Give me the steps + and I'll do it." Jason installed the packages: rootlesskit 3.2.0, + slirp4netns 1.3.6, libslirp 4.9.5, docker-rootless-extras 29.9.0 + (AUR). Mos did the user-level setup. + - Sage checked it at 14:46Z, read-only. The endpoint + unix:///run/user/1000/docker.sock answers with server 29.7.2 and + security options seccomp, rootless and cgroupns. It uses cgroup + driver systemd v2, storage overlayfs, and data root + /mnt/storage/docker-rootless/data (jwoltje, mode 710, which + dockerd sets itself). User unit docker.socket is enabled and + active, docker.service is active, and linger is on. + DOCKER_HOST is unset, the CLI context is `default`, and the + rootful daemon still runs its 20 containers. + - Only the Mosaic containerized install uses the rootless daemon. + Nothing existing moves to it. The pi worker path stays on the + rootful daemon until it migrates under the I1 brief. + - The I1 brief pins the endpoint explicitly, never through the + ambient context or DOCKER_HOST. Before any launch it refuses + unless `docker info` on that endpoint lists `name=rootless`. + Neither engine socket is mounted into any container. + - Not fixed by this: jwoltje stays in the `docker` group, so any + host process under his uid can still reach the rootful daemon's + socket, which is root-equivalent. That is the same class as + decision 95's host-side limit and is recorded, not closed. + - `execution.backend` stays `docker`, and no allowlist change is + needed. How the endpoint gets into config is the brief's design + item. A config schema change goes through review like any other.