From 543ccc3ed48c44954d4a689db2e0d4be10fe931c Mon Sep 17 00:00:00 2001
From: Paulo <commonzenpython@gmail.com>
Date: Mon, 17 Aug 2026 12:53:09 +0200
Subject: [PATCH] The remote shape mounts the Docker socket for browser
 containers

Remote meant cloud sandboxes, so only the local overlay mounted the
socket. Browser-session containers run on the box's own daemon through
the docker provider in either shape, so the remote drukbox needs the
same mount, the socket's gid, and the browser image's ssh user.
install.sh stamps DRUKS_DOCKER_GID for both shapes now.
---
 deploy/compose.remote.yaml |  9 +++++++++
 scripts/install.sh         | 20 +++++++++++---------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/deploy/compose.remote.yaml b/deploy/compose.remote.yaml
index 5c795342..2d0147e5 100644
--- a/deploy/compose.remote.yaml
+++ b/deploy/compose.remote.yaml
@@ -7,10 +7,19 @@
 x-drukbox: &drukbox
   image: ${DRUKS_SANDBOX_SERVICE_IMAGE:-ghcr.io/czpython/drukbox:latest}
   network_mode: host
+  # Cloud VMs are the sandbox home; the mounted socket serves the docker
+  # provider that browser-session containers run on. install.sh records the
+  # socket's gid so drukbox's non-root appuser may use it.
+  group_add:
+    - "${DRUKS_DOCKER_GID:-0}"
+  volumes:
+    - /var/run/docker.sock:/var/run/docker.sock
   env_file:
     - ./.env
   environment:
     DATABASE_URL: postgresql+psycopg://${DRUKS_POSTGRES_USER:-druks}:${DRUKS_POSTGRES_PASSWORD}@127.0.0.1:5432/drukbox
+    # Browser containers run sshd for the druks user, not root.
+    DOCKER_SSH_USERNAME: druks
   depends_on:
     postgres:
       condition: service_healthy
diff --git a/scripts/install.sh b/scripts/install.sh
index ff5fa7ff..40335830 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -124,17 +124,19 @@ main() {
 
   # COMPOSE_FILE → .env, so plain `docker compose` in this dir loads the right
   # overlay. `local` drives sandboxes on the host Docker daemon (dashboard on
-  # :8001, no Caddy); `remote` runs the cloud provider + Caddy. For local, the
-  # socket's gid rides along so drukbox's non-root appuser may use it — on
-  # macOS the host path is a user-owned symlink, but the socket Docker Desktop
-  # mounts into containers is group root, so the host gid would grant nothing.
+  # :8001, no Caddy); `remote` runs the cloud provider + Caddy. Both shapes
+  # mount the Docker socket — sandboxes on local, browser-session containers
+  # on remote — so the socket's gid rides along and drukbox's non-root appuser
+  # may use it. On macOS the host path is a user-owned symlink, but the socket
+  # Docker Desktop mounts into containers is group root, so the host gid would
+  # grant nothing.
+  if [ "$(uname -s)" = "Darwin" ]; then
+    set_env_var DRUKS_DOCKER_GID "0"
+  else
+    set_env_var DRUKS_DOCKER_GID "$(stat -c '%g' /var/run/docker.sock)"
+  fi
   if [ "$PROVIDER" = "docker" ]; then
     set_env_var COMPOSE_FILE "compose.yaml:compose.local.yaml"
-    if [ "$(uname -s)" = "Darwin" ]; then
-      set_env_var DRUKS_DOCKER_GID "0"
-    else
-      set_env_var DRUKS_DOCKER_GID "$(stat -c '%g' /var/run/docker.sock)"
-    fi
   else
     set_env_var COMPOSE_FILE "compose.yaml:compose.remote.yaml"
   fi