asahi: docker + act stack is now enabled on the Mac — confirm that's wanted

[cernoh]

attrs/desktop pulls the act feature, which composes docker. ASAHI imports desktop, so the Mac gains virtualisation.docker.enable = true and a system-level act CLI for the first time.

• Decide: do you want container tooling on this machine? If yes, nothing to do. If no, opt ASAHI out (e.g. split act out of attrs/desktop into its own opt-in module or gate per host) — don't leave it running unused.
• First start on the Asahi kernel: systemctl status docker containerd after switch; confirm bridge/nf_tables modules load (docker info without errors).
• Disk budget: Docker lives under /var/lib/docker on the Mac's internal SSD; prune early (docker system prune) if space-tight.
• .actrc lands at /home/da/.actrc with -P ubuntu-latest=catthehacker/ubuntu:act-latest; sanity-run act --version and one tiny workflow if you intend to use it here.

Related: #60 (integration), #63.

[cernoh]

Decision (2026-08-25): keep it. Container tooling is wanted on the Mac; ASAHI stays on attrs/desktop → act → docker. Eval confirms virtualisation.docker.enable = true on both hosts now.

First-start checks remain open until the switch lands and will be done then:

• systemctl status docker containerd, docker info (bridge/nf_tables modules on the Asahi kernel)
• disk budget check on /var/lib/docker
• .actrc sanity: it's declared via HM for the primary user (da here, so /home/da/.actrc with the catthehacker default); act --version + one tiny workflow after switch

[cernoh]

Decision stands: keep docker + act on the Mac. First-start checks (systemctl status docker containerd, docker info bridge/nf_tables on the Asahi kernel, /var/lib/docker budget, .actrc sanity) are Mac-side post-switch and tracked in #62 — nothing further from NIXPC until the ASAHI switch runs.

[cernoh]

Agent pass (2026-08-28, from ASAHI):

• Decide: kept as-is — docker is act's runtime, composed via attrs/desktop → act → docker for every desktop host (NIXPC MCP containers depend on the daemon too). No unused-resource concern here: /var/lib/docker is 4K (no images pulled). If you want it off the Mac specifically, the clean split is moving act's docker import behind a per-host opt-in; say the word and I'll file it.
• First start: docker is active (uptime since Mar — predates this config, so a re-verify after the next switch is still warranted); containerd.service is inactive on this machine — docker 29.x runs its embedded containerd, and docker info reports no bridge/nf_tables errors, so this looks benign, but flag it if you saw bridge issues.
• Disk budget: /var/lib/docker = 4K — fine.
• .actrc / act: /home/da/.actrc present with the catthehacker override; act --version = 0.2.89. act: move .actrc content out of the HM module (tracked file or flag/env) #96 (PR feat(act): deliver .actrc via out-of-store symlink to tracked file #103) moves the rc to a repo-tracked symlink.

Remaining: a tiny act workflow run on this machine (needs a workflow to exercise) and the post-switch docker re-verify.