From 4fc9d9b78131469fc3cc80ba09c3662fd6ed8dec Mon Sep 17 00:00:00 2001
From: Adil Atalay Hamamcioglu <38231748+recoskyler@users.noreply.github.com>
Date: Sat, 7 Mar 2026 15:05:11 +0000
Subject: [PATCH 1/2] fix: allow docker usage without sudo in devcontainer

Add an entrypoint script that dynamically matches the container's docker
group GID to the bind-mounted socket's GID, enabling rootless docker
access regardless of the host's docker group configuration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 base/Dockerfile            |  4 ++++
 scripts/docker-sock-fix.sh | 28 ++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 scripts/docker-sock-fix.sh

diff --git a/base/Dockerfile b/base/Dockerfile
index 39ec4be..eb887c7 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -251,4 +251,8 @@ RUN agent-browser install --with-deps
 
 RUN chown -R dev:dev /home/dev
 
+COPY scripts/docker-sock-fix.sh /usr/local/bin/docker-sock-fix.sh
+RUN chmod +x /usr/local/bin/docker-sock-fix.sh
+ENTRYPOINT ["docker-sock-fix.sh"]
+
 USER dev
diff --git a/scripts/docker-sock-fix.sh b/scripts/docker-sock-fix.sh
new file mode 100644
index 0000000..8e98d52
--- /dev/null
+++ b/scripts/docker-sock-fix.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+# Fix Docker socket permissions so the dev user can use docker without sudo.
+# When /var/run/docker.sock is bind-mounted from the host, its GID may not
+# match the container's "docker" group. This script updates the container's
+# docker group GID to match the socket's GID, then re-execs with the new group.
+
+SOCKET="/var/run/docker.sock"
+
+if [ -S "$SOCKET" ]; then
+    SOCK_GID=$(stat -c '%g' "$SOCKET")
+    CUR_GID=$(getent group docker | cut -d: -f3)
+
+    if [ "$SOCK_GID" != "$CUR_GID" ]; then
+        # Check if another group already uses this GID
+        EXISTING=$(getent group "$SOCK_GID" | cut -d: -f1)
+        if [ -n "$EXISTING" ] && [ "$EXISTING" != "docker" ]; then
+            sudo groupmod -g 99999 "$EXISTING"
+        fi
+        sudo groupmod -g "$SOCK_GID" docker
+    fi
+
+    # Re-exec with updated docker group if not already applied
+    if ! id -G | tr ' ' '\n' | grep -q "^${SOCK_GID}$"; then
+        exec sg docker "$(printf '%q ' "$@")"
+    fi
+fi
+
+exec "$@"

From 2ea3f4aa0f56aac15fe1dfdf2cd76a03eb62aef2 Mon Sep 17 00:00:00 2001
From: Adil Atalay Hamamcioglu <38231748+recoskyler@users.noreply.github.com>
Date: Sat, 7 Mar 2026 15:05:48 +0000
Subject: [PATCH 2/2] docs: update README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 759c2e4..a05a516 100644
--- a/README.md
+++ b/README.md
@@ -162,7 +162,7 @@ All images extend a shared base (`base/Dockerfile` — `debian:trixie`) and run
 - **MCP servers**: Serena, Context7, Automem
 - **GSD** (Get Shit Done for Claude Code)
 - **Agent Browser** + Chrome
-- **Docker** CLI + Compose plugin (`docker`, `docker compose`) — mount the host socket to use
+- **Docker** CLI + Compose plugin (`docker`, `docker compose`) — mount the host socket to use; works without `sudo` (the entrypoint automatically matches the socket's GID)
 - **CLI tools**: git, curl, wget, vim, nano, jq, tmux, xclip, openssh-client, gnupg, cmake, less, unzip, gh, pnpm, tsx
 - **Search & file tools**: ripgrep, fd-find, fzf, bat, tree
 - **PDF tools**: poppler-utils (pdftotext, pdfinfo, etc.)