Package Podman defaults and rootless ONCE

[acrogenesis]

Rootless ONCE package and service

Add a checksum-pinned ONCE v0.3.2 source build with the rootless proxy, Podman backup/restore and exec-completion fixes. The binary identifies as v0.3.2-omarchy1, provides once-bin for existing package/menu guards, and requires neither a Docker daemon nor the Podman Docker CLI shim. The vendor once-bin package remains separate; the preserved system unit is not automatically enabled. The source package is locally maintained so upstream synchronization cannot silently discard the patch.

Both settings variants conditionally install the source-provided omarchy-once.service user unit. Omarchy's optional installer enables it and user lingering after checking the selected rootless engine. Existing rootful ONCE workloads still require explicit migration.

Validation: real makepkg build/install in Lab, complete internal Go suite plus new regression tests, four actual settings payload builds, packaging/upstream-sync self-tests, and real Writebook content/credentials, backup/restore, replacement, scheduled tasks and reboot on both engines. Source package contents and patch are identical in the two companion proposals. Fresh ISO acceptance remains separate.

Package Podman TUI for terminal container management and the Podman Docker-API environment generator in both settings variants while preserving active Docker configuration during pending migrations. An in-place settings upgrade must not remove configuration for an installed engine, including alternate providers such as docker-git.

Changes

• Install the source-provided podman-restart.service.d/10-local.conf override in both settings variants when available. Managed login/logout lifecycle stays local even when an interactive remote endpoint is configured; older sources retain their existing payload.
• Add the AUR-derived podman-tui 2.0.0 recipe with tracked upstream metadata. A durable local patch declares podman>=6 at package scope, matching the upstream compatibility requirement and retaining it in the built package metadata.
• Install the generator as mode 755 under /usr/lib/systemd/user-environment-generators/ only when the selected source contains it. Pinned stable source 0534987 still builds and retains its Docker defaults.
• Retain legacy Docker configuration files and backup metadata in the payload so pacman preserves active custom settings during in-place upgrades. For Podman sources, include stock reference copies under /usr/share/omarchy/retired-docker/ and declare diffutils for content comparison.
• Retire configuration only when no Docker provider is installed or the provider is podman-docker. Preserve configuration for alternate engines and failed package-database reads. Remove stock defaults and archive custom files without overwriting prior backups; later upgrades and reinstalls apply the same policy.
• Keep API activation conditional on podman-docker, preserving explicit endpoint/context variables. Installing settings alone does not redirect SDK clients before migration.

Retired compatibility files remain recorded in package metadata. The preservation guarantee covers in-place upgrades; switching between stable and dev package names retains pacman's existing .pacsave replacement behavior.

Validation

• Local restart override (57ff1ba): upstream-sync and package self-tests pass. Four real package() builds cover both settings variants against current Podman source and pinned stable 0534987, verifying override bytes/mode 644 when present and omission for older sources. A scoped Lab service using the override starts/stops a local container despite an unavailable CONTAINER_HOST endpoint.
• Podman TUI (dd66c49): upstream sync and packaging self-tests pass; the tracked patch regenerates cleanly. Built and installed podman-tui-2.0.0-1.1 in Omarchy Lab and verified .PKGINFO requires podman>=6. With Podman 6.1.1, the companion launcher connects rootlessly and displays a running Redis container and its logs. Fresh ISO validation of this addition remains pending publication to Omarchy's package mirror.
• Current scriptlets (538c25e): 14 scenarios pass across both variants, covering pending migrations, post-migration upgrades/reinstalls, fresh Podman and older-source installs, alternate-provider upgrades/reinstalls, failed queries and no-provider installs. Provider cases use real packages and pacman transactions in disposable Arch containers. Query-error cases invoke the actual retirement function with a failing pacman stub.
• The alternate-provider regression fails against the preceding scriptlets; the earlier removed-file layout fails configuration preservation.
• Build-isolation and self-tests CI both pass, including the package regression suite.
• Earlier execution of both real package() functions against pinned stable and Podman sources verified all four payloads, generator contents/mode, Docker backup metadata and stock reference copies.
• Earlier packaged ISO checks verified ownership/permissions, fresh installation, the 92-second graphical/API suite and real migration/reboot behavior. That ISO predates the latest scriptlet fixes; these fixes were validated through the package scenarios and CI above.

Companions: omacom/omarchy#11032 (runtime and migration) and omacom/omarchy-iso#171 (builder and migration scenario).

Fresh packaged Podman Desktop during the successful API socket lifecycle check:

Latest review: independent Claude Fable 5.1 and Codex followups report no actionable findings. Both build-isolation and self-tests pass in CI run 34910006155 after resolving the upstream workflow conflict.

[ErikMelton]

One thing I noticed. The configuration for alternate Docker providers can be clobbered here: pacman -Qq docker != docker (omarchy-settings-dev/omarchy-settings-dev.install#L63) which assumes only the package literally named docker can be the real engine. Pacman resolves virtual packages to their installed provider; for example, docker-git provides docker so the query would return docker-git. The scriptlet then deletes stock configuration or archives custom configuration while the real Docker engine remains installed, violating the pending-migration safeguard. We should treat only an empty result or podman-docker as retired, mirror the fix in both install files, and add an alternate-provider fixture.

This isn't relevent though if we intentionally only support Arch's official docker package and explictly exclude other providers. Then this can be ignored!

[acrogenesis]

@ErikMelton Fixed in both settings variants: alternate Docker providers now retain their configuration. Added a docker-git regression fixture; real pacman tests and CI pass. Thanks!