From 6a026ecf9fa43305a31ee130bb334d28c1abe006 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Fri, 2 Oct 2026 15:58:12 +0800
Subject: [PATCH] chore(desktop): make podman rootless-only

Disable the rootful system podman.socket on desktop hosts and drop the module's autoPrune, which prunes the rootful store and pulls in the rootful API service. Add a weekly per-user timer that prunes the rootless store instead.
---
 modules/nixos/desktop/containers.nix | 38 +++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/modules/nixos/desktop/containers.nix b/modules/nixos/desktop/containers.nix
index 5e949bd4..4c8ea779 100644
--- a/modules/nixos/desktop/containers.nix
+++ b/modules/nixos/desktop/containers.nix
@@ -1,4 +1,8 @@
-{ ... }:
+{
+  config,
+  lib,
+  ...
+}:
 {
   ###################################################################################
   #
@@ -13,12 +17,9 @@
       dockerCompat = true;
       # Required for containers under podman-compose to be able to talk to each other.
       defaultNetwork.settings.dns_enabled = true;
-      # Periodically prune Podman resources
-      autoPrune = {
-        enable = true;
-        dates = "weekly";
-        flags = [ "--all" ];
-      };
+      # No `autoPrune`: it prunes the *rootful* store and depends on the rootful
+      # API service, neither of which a rootless-only desktop uses. Prune the
+      # rootless store with the user timer below instead.
     };
 
     # Bound container log growth. Podman uses journald when the journal is
@@ -26,4 +27,27 @@
     # (k8s-file / json-file), which otherwise grows without limit.
     containers.containersConf.settings.containers.log_size_max = 10 * 1024 * 1024;
   };
+
+  # Desktop hosts use rootless podman only: the user is not in the `podman`
+  # group, so the rootful system socket is unreachable and nothing here uses the
+  # Docker/podman API. Disable it anyway so it cannot be reached by accident.
+  # The per-user rootless socket (systemd.user.sockets.podman) is unaffected.
+  systemd.sockets.podman.enable = false;
+
+  # Prune the rootless store (the module's autoPrune only covered the rootful
+  # one). Runs in the user's session, so it fires while the desktop is logged in.
+  systemd.user.services.podman-prune = {
+    description = "Prune rootless podman resources";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${lib.getExe config.virtualisation.podman.package} system prune -f --all";
+    };
+  };
+  systemd.user.timers.podman-prune = {
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      OnCalendar = "weekly";
+      Persistent = true;
+    };
+  };
 }