From d6398e71c39ee8d36712be7a5ff6dcfd87aec6f2 Mon Sep 17 00:00:00 2001 From: David McKay Date: Fri, 4 Sep 2026 13:24:41 -0700 Subject: [PATCH] Let the engine socket be somewhere other than /var/run/docker.sock Compose mounted that path into the supervisor as a fixed source. It is right on Docker, and on Podman on macOS, where `podman machine` symlinks it to the rootless socket inside the virtual machine, which is why the mount needed no change there. It is wrong on rootless Podman on Linux. The path is either absent or, with podman-docker installed, a symlink to /run/podman/podman.sock: the rootful socket, not the one running. The supervisor is handed a dead socket and every request for a Bot's computer fails with "The supervisor could not reach Docker". The source is now ENGINE_SOCKET, defaulting to the old path, so a deployment that does not set it behaves exactly as before. Verified on Ubuntu 24.04, rootless Podman 4.9.3, arm64: the smoke journey failed on that one test before the change and passes after, with the supervisor creating the Bot's computer through the rootless socket. --- CHANGELOG.md | 12 ++++++++++++ docker-compose.yml | 12 ++++++++++-- docs/configuration.md | 8 ++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c84ac8a0..aae4275b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,18 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged. ## Unreleased +### The engine socket the supervisor is given can be pointed somewhere else + +Compose mounted `/var/run/docker.sock` into the supervisor as a fixed path. That is correct for +Docker, and for Podman on macOS, where `podman machine` symlinks it to the rootless socket inside the +virtual machine. It is wrong for rootless Podman on Linux, where the path is either absent or, with +`podman-docker` installed, a symlink to `/run/podman/podman.sock`, the rootful socket, which is not +the one running. The supervisor held a dead socket and every attempt to give a Bot a computer failed +with a message about not reaching Docker. + +The mount source is now `ENGINE_SOCKET`, defaulting to `/var/run/docker.sock`, so nothing changes +unless it is set. On rootless Podman on Linux, set it to `$XDG_RUNTIME_DIR/podman/podman.sock`. + ### A Bot's computer is waited for properly on Podman, and the supervisor can reach the engine there Two things stopped OpenBot running on Podman, which nothing had tried before. diff --git a/docker-compose.yml b/docker-compose.yml index 6c8928a9..6fca5a72 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -160,7 +160,7 @@ services: - spire-agent-socket:/tmp/spire-agent/public - spire-agent-data:/opt/spire/data # Read-only, and only so the docker workload attestor can see which container is asking. - - /var/run/docker.sock:/var/run/docker.sock:ro + - ${ENGINE_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro # One computer per Bot. # @@ -220,7 +220,15 @@ services: volumes: # Read-only because this service only ever needs to ask; it is still root-equivalent, which is # the whole reason nothing else here gets it. - - /var/run/docker.sock:/var/run/docker.sock:ro + # + # The source is a setting because the default is wrong on one of the engines this runs on. + # Docker puts its socket at this path, and so does Podman on macOS, where `podman machine` + # symlinks it to the rootless socket inside the virtual machine. Rootless Podman on Linux does + # not: the path is either absent or, with podman-docker installed, a symlink to + # /run/podman/podman.sock, which is the *rootful* socket and is not the one running. The + # supervisor then holds a dead socket and reports that it cannot reach Docker. Point + # ENGINE_SOCKET at $XDG_RUNTIME_DIR/podman/podman.sock there. + - ${ENGINE_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro # To register an entry per Bot as each computer is created. - spire-server-socket:/tmp/spire-server/private security_opt: diff --git a/docs/configuration.md b/docs/configuration.md index 782622fe..50fed72d 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -303,6 +303,14 @@ The supervisor also reads: - `COMPUTER_MEMORY_BYTES` - `DOCKER_SOCKET` +`ENGINE_SOCKET` is separate from those, because it is read by Compose rather than by the supervisor: +it is the host path mounted into the supervisor as `/var/run/docker.sock`. Unset, it is +`/var/run/docker.sock`, which is right for Docker and for Podman on macOS, where `podman machine` +symlinks that path to the rootless socket. Rootless Podman on Linux needs +`ENGINE_SOCKET=$XDG_RUNTIME_DIR/podman/podman.sock`: there the default path is either missing or a +symlink to the rootful socket, which is not the one running, and the supervisor reports that it +cannot reach Docker. + `COMPUTER_NAMESPACE` defaults to `openbot` and names the deployment a computer belongs to. It is part of every container and volume name the supervisor derives, and the supervisor acts only on computers carrying it, so two deployments on one Docker host never adopt each other's.