Update to Cloud Environment

Changed files

Choose a file to see its text changes. Binary or large files show metadata only.

SKILL.md →

references/docker.md →

references/networking.md →

references/packages.md →

references/vpn.md →

references/docker.md

− removed · + added

--- before
+++ after
@@ -26,7 +26,9 @@
 Keep the existing storage driver, data directory, and socket group. For the
 provided daemon defaults, the following command refuses to start a second daemon
 and removes the stale pidfile only after confirming no `dockerd` process is
-running:
+running. It creates a fresh runtime directory so restored containerd PID and
+socket files cannot interfere with startup; Docker's persistent data stays in
+its existing location:
 
 ```sh
 (
@@ -40,10 +42,12 @@
 fi
 install -d -m 0700 /run/codex-docker
 rm -f /run/codex-docker/dockerd.pid
+docker_exec_root="$(mktemp -d /run/codex-docker/exec-XXXXXX)"
 docker_socket_gid="$(stat -c %g /var/run/docker.sock 2>/dev/null || id -g)"
 nohup /usr/local/bin/dind /usr/local/bin/dockerd \
     --host=unix:///var/run/docker.sock \
     --pidfile=/run/codex-docker/dockerd.pid \
+    --exec-root="$docker_exec_root" \
     --storage-driver="${CAAS_DIND_STORAGE_DRIVER:-vfs}" \
     --group="$docker_socket_gid" \
     >/run/codex-docker/dockerd.log 2>&1 </dev/null &
@@ -53,8 +57,9 @@
 Repeat the local-socket health check above until it succeeds before Docker work;
 inspect the daemon log if it does not become ready within 60 seconds. To restart
 an unhealthy daemon as root, inspect its log and existing arguments, stop that
-specific process, wait for it to exit, and start it with the same settings and
-proxy environment.
+specific process and wait for it to exit. Start it with a fresh runtime directory
+as above, preserving its data directory, storage driver, socket group, and proxy
+environment.
 Restarting interrupts running containers. Do not launch a competing daemon or
 change storage drivers to recover it.
 
@@ -108,12 +113,15 @@
 ## Running containers
 
 New containers receive Docker's default proxy environment. Give a process that
-needs HTTPS a read-only CA mount and its appropriate trust setting. For example:
+needs HTTPS a read-only CA mount and its appropriate trust setting. For this
+example, use Node.js 22.21 or newer; `NODE_USE_ENV_PROXY=1` makes `fetch()` use
+the inherited proxy settings:
 
 ```sh
 docker run --rm \
     --mount "type=bind,src=$CODEX_PROXY_CERT,dst=/run/proxy-ca.pem,readonly" \
     -e NODE_EXTRA_CA_CERTS=/run/proxy-ca.pem \
+    -e NODE_USE_ENV_PROXY=1 \
     node:22-bookworm-slim \
     node -e 'fetch("https://registry.npmjs.org").then(r => { if (!r.ok) process.exit(1); })'
 ```