Let the engine socket be somewhere other than /var/run/docker.sock

CHANGELOG.md

@@ -8,6 +8,18 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### The engine socket the supervisor is given can be pointed somewhere else
+
+Compose mounted `/var/run/docker.sock` into the supervisor as a fixed path. That is correct for
+Docker, and for Podman on macOS, where `podman machine` symlinks it to the rootless socket inside the
+virtual machine. It is wrong for rootless Podman on Linux, where the path is either absent or, with
+`podman-docker` installed, a symlink to `/run/podman/podman.sock`, the rootful socket, which is not
+the one running. The supervisor held a dead socket and every attempt to give a Bot a computer failed
+with a message about not reaching Docker.
+
+The mount source is now `ENGINE_SOCKET`, defaulting to `/var/run/docker.sock`, so nothing changes
+unless it is set. On rootless Podman on Linux, set it to `$XDG_RUNTIME_DIR/podman/podman.sock`.
+
 ### A Bot's computer is waited for properly on Podman, and the supervisor can reach the engine there
 
 Two things stopped OpenBot running on Podman, which nothing had tried before.

docker-compose.yml

@@ -160,7 +160,7 @@ services:
       - spire-agent-socket:/tmp/spire-agent/public
       - spire-agent-data:/opt/spire/data
       # Read-only, and only so the docker workload attestor can see which container is asking.
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ${ENGINE_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
 
   # One computer per Bot.
   #
@@ -220,7 +220,15 @@ services:
     volumes:
       # Read-only because this service only ever needs to ask; it is still root-equivalent, which is
       # the whole reason nothing else here gets it.
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      #
+      # The source is a setting because the default is wrong on one of the engines this runs on.
+      # Docker puts its socket at this path, and so does Podman on macOS, where `podman machine`
+      # symlinks it to the rootless socket inside the virtual machine. Rootless Podman on Linux does
+      # not: the path is either absent or, with podman-docker installed, a symlink to
+      # /run/podman/podman.sock, which is the *rootful* socket and is not the one running. The
+      # supervisor then holds a dead socket and reports that it cannot reach Docker. Point
+      # ENGINE_SOCKET at $XDG_RUNTIME_DIR/podman/podman.sock there.
+      - ${ENGINE_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock:ro
       # To register an entry per Bot as each computer is created.
       - spire-server-socket:/tmp/spire-server/private
     security_opt:

docs/configuration.md

@@ -303,6 +303,14 @@ The supervisor also reads:
 - `COMPUTER_MEMORY_BYTES`
 - `DOCKER_SOCKET`
 
+`ENGINE_SOCKET` is separate from those, because it is read by Compose rather than by the supervisor:
+it is the host path mounted into the supervisor as `/var/run/docker.sock`. Unset, it is
+`/var/run/docker.sock`, which is right for Docker and for Podman on macOS, where `podman machine`
+symlinks that path to the rootless socket. Rootless Podman on Linux needs
+`ENGINE_SOCKET=$XDG_RUNTIME_DIR/podman/podman.sock`: there the default path is either missing or a
+symlink to the rootful socket, which is not the one running, and the supervisor reports that it
+cannot reach Docker.
+
 `COMPUTER_NAMESPACE` defaults to `openbot` and names the deployment a computer belongs to. It is part
 of every container and volume name the supervisor derives, and the supervisor acts only on computers
 carrying it, so two deployments on one Docker host never adopt each other's.