Runtime

Docker

How Docker is set up on this machine, and which containers auto-start. Updated 2026-07-26.

Overview

Omarchy stock install leaves Docker socket-activated only (docker.socket enabled, docker.service disabled), so dockerd starts on first API use — e.g. docker ps — and restart-policy containers come up then (often showing ~1s uptime). This machine overrides that: docker.service is also enabled, so the daemon and mongo start at boot without waiting for a client.

Item	Status
`docker.socket`	Enabled (stock; still present)
`docker.service`	Enabled (custom — starts dockerd at boot)
Auto-start containers	`mongo`, `cloudflared` (`unless-stopped`)
User access	`sparks` in group `docker`

Daemon config

/etc/docker/daemon.json

{
    "log-driver": "json-file",
    "log-opts": { "max-size": "10m", "max-file": "5" },
    "dns": ["172.17.0.1"],
    "bip": "172.17.0.1/16"
}

Log rotation caps at 10 MB × 5 files per container.
DNS points at the Docker bridge gateway; systemd-resolved listens there via /etc/systemd/resolved.conf.d/20-docker-dns.conf.
Drop-in /etc/systemd/system/docker.service.d/no-block-boot.conf sets DefaultDependencies=no so Docker does not delay network-online.target.

Containers (boot / auto-start)

These containers come back at boot (via docker.service + restart policy):

Name	Image	Restart	Publish	Auth	Notes
`mongo`	`mongo` (8.2.x)	`unless-stopped`	`0.0.0.0:27017→27017`	None	Dev DB for Compass favorite `dev` / hailmary. URI `mongodb://localhost:27017/`
`cloudflared`	`cloudflare/cloudflared:latest`	`unless-stopped`	Host network (metrics `:20241`)	Tunnel token	Remotely managed Cloudflare Tunnel `9948ba30-…a939`. See Cloudflare Tunnel.

Data lives in anonymous Docker volumes under /data/db and /data/configdb. This is not the Omarchy helper layout from omarchy-install-docker-dbs (that would create a container named mongodb on 127.0.0.1:27017 with admin / admin123).

# Useful checks
docker ps
docker logs mongo --tail 50
docker logs cloudflared --tail 50

Other mongo containers on the machine (random names, restart=no, exited) are leftovers and do not start. Safe to prune when you no longer need them: docker container prune.

Compass / Work session connect to this instance — see Work session.

Cloudflare Tunnel

Official image cloudflare/cloudflared runs a remotely managed tunnel. Ingress (public hostnames → local origins) is configured in the Cloudflare dashboard, not in a local config.yml. The container uses --network host so origins like localhost:27017 resolve on the machine.

Item	Value
Tunnel ID	`9948ba30-f687-41c0-90b2-04272ae7a939`
Token file	`~/.config/cloudflared/tunnel.token` (`chmod 600`)
Metrics	`http://localhost:20241/metrics`
Dashboard	Networking → Tunnels

Account resource changes (Workers, R2, DNS, etc.) are not done by cloudflared — use the Cloudflare dashboard, API/wrangler, or Cursor’s Cloudflare MCP. The tunnel only connects this host to Cloudflare’s edge.

# Health
docker logs cloudflared --tail 50
curl -sS localhost:20241/ready

Recreate

Confirm Omarchy Docker install left /etc/docker/daemon.json, resolved DNS stub, and docker.socket enabled.
Enable the daemon at boot (not stock Omarchy — without this, containers wait until first docker client use):

sudo systemctl enable --now docker.service

Ensure your user is in group docker (log out/in after usermod -aG docker $USER).
Start the mongo container (destroys anonymous volume data unless you migrate):

docker run -d --restart unless-stopped -p 27017:27017 --name mongo mongo

Restore the tunnel token to ~/.config/cloudflared/tunnel.token (chmod 600), then:

TOKEN=$(cat ~/.config/cloudflared/tunnel.token)
docker run -d --name cloudflared --restart unless-stopped --network host \
  cloudflare/cloudflared:latest \
  tunnel --no-autoupdate run --token "$TOKEN"

Get a fresh token from the tunnel’s Overview → Add a replica if the file is missing. Do not commit the token.

File index

/etc/docker/daemon.json
/etc/systemd/resolved.conf.d/20-docker-dns.conf
/etc/systemd/system/docker.service.d/no-block-boot.conf
~/.config/cloudflared/tunnel.token