nested-podman-socket
| Version | 2026.243.0100 |
| Repo | box/github.com/opencharly/pod-nested-podman-socket:v2026.243.0411 |
Serves the nested rootless podman API socket at uid 1000, so a pod’s OWN podman store is reachable as an API endpoint rather than only as a CLI inside the container.
container-nesting supplies nested rootless podman; this candy supplies its SOCKET. The
two are separate because a nesting box that only builds and runs containers needs no
API endpoint, while anything that must be driven from outside the container — the
charly box load delivery verb, or an AgentTeams controller spawning Manager/Worker
containers into the pod’s own store — needs exactly that endpoint. Composing this
candy is what makes a pod a venue charly box load can deliver into.
The socket’s store IS the container’s rootless store (container-nesting’s user storage.conf graphroot), which is the whole point: containers spawned through it stay inside the candybox instead of landing in the host store beside everything else.
Services
Section titled “Services”podman-socket
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
seed the uid-1000 runtime dir so the named volume copies it up at first start |
check |
the seeded runtime dir is uid-1000-owned as a WHOLE, not just its podman/ subdir |
check |
the podman binary the socket serves is present |
check |
the API socket exists at the uid-1000 runtime path |
check |
the socket answers, and its store is the container’s OWN rootless store |