agent-vm 57deafa8ce image: put /usr/sbin on PATH so dockerd finds iptables / docker-proxy ... The previous fix symlinked /usr/sbin/{dockerd,runc} into /usr/local/bin so users could invoke `dockerd` directly, but that was whack-a-mole — dockerd itself does PATH lookup at runtime for its helper binaries: - `iptables` (from `iptables` pkg, /usr/sbin/iptables): dockerd aborts with "failed to register \"bridge\" driver: failed to create NAT chain DOCKER: iptables not found". - `docker-proxy` (from docker.io pkg, /usr/sbin/docker-proxy): daemon.json validation fails with "userland-proxy is enabled, but userland-proxy-path is not set" (the daemon resolves a default path via PATH lookup before parsing the config). - `runc` (also /usr/sbin/runc): containerd-shim PATH-looks it up when starting containers. Symlinking each one would be unending whack-a-mole as new helpers get added in future docker.io revs. Adding /usr/sbin to PATH covers all of them in one line; drop the redundant dockerd/runc symlinks from the previous fix. Verified end-to-end inside an agent-vm session built from the broken (v0.1.11) image: with `PATH=$PATH:/usr/sbin dockerd &` the daemon starts cleanly, `docker run hello-world` prints the welcome message, `docker run alpine sh -c 'echo running uid=$(id -u)'` runs a real container (uid=0, kernel 6.12.68), iptables NAT chain DOCKER is populated, docker0 bridge comes up. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>		2026-05-27 18:39:49 +00:00
..
build.sh	agent-vm/images: switch image build to zstd-compressed layers	2026-05-25 19:34:44 +00:00
Dockerfile	image: put /usr/sbin on PATH so dockerd finds iptables / docker-proxy	2026-05-27 18:39:49 +00:00