The remote shape mounts the Docker socket for browser containers - #270
Merged
Conversation
Remote meant cloud sandboxes, so only the local overlay mounted the socket. Browser-session containers run on the box's own daemon through the docker provider in either shape, so the remote drukbox needs the same mount, the socket's gid, and the browser image's ssh user. install.sh stamps DRUKS_DOCKER_GID for both shapes now.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remote meant cloud sandboxes, so only the local overlay mounted the Docker socket. Browser-session containers run on the box's own daemon through the docker provider in either shape — seen on the live box after the drukbox tailnet fix (czpython/drukbox#9):
ProviderTransportError: failed to connect to the docker API at unix:///var/run/docker.sock, because the drukbox containers had no socket at all.The
x-drukboxanchor in compose.remote.yaml now mounts/var/run/docker.sock, joins the socket's group (DRUKS_DOCKER_GID, the same knob the local overlay uses), and setsDOCKER_SSH_USERNAME: druks— the browser image runs sshd for the druks user, not the provider's root default. install.sh stampsDRUKS_DOCKER_GIDfor both shapes instead of only the local one.Verified by rendering the merged config: both drukbox services (API + janitor) carry the mount, the gid, and the ssh user.
Live-box migration (one-time, current deploys don't refresh compose): copy the updated compose.remote.yaml, add
DRUKS_DOCKER_GID=<socket gid>to .env,docker compose up -d drukbox drukbox-janitor.