Emma Thorpe 1cb8371775 feat(rpi5): add Docker host with LAN-restricted network socket ...

Enable Docker and expose the daemon over TCP 2375 by extending the systemd
docker.socket ListenStream (avoids the daemon.json hosts vs unit -H fd://
conflict). The port is not added to allowedTCPPorts; instead an nftables
rule accepts it only from the trusted LAN subnet. Plain 2375 is
root-equivalent, so the source restriction is the only safeguard -- mTLS on
2376 is the documented upgrade path.

2026-06-16 13:25:31 +01:00

..

docker.nix

feat(rpi5): add Docker host with LAN-restricted network socket

2026-06-16 13:25:31 +01:00

hardware-configuration.nix

feat(rpi5): add placeholder hardware-configuration

2026-06-16 13:25:02 +01:00