Fix SocketPath to return actual socket path for rootless Docker

Author: gtsiolis

internal/runtime/docker.go

@@ -63,15 +63,41 @@ func probeSocket(candidates ...string) string {
 	return ""
 }
 
+// isVM reports whether the Docker daemon is running inside a VM (e.g., Colima, OrbStack).
+// In these cases the socket is remapped inside the VM and the container sees it at
+// /var/run/docker.sock even if the CLI connects via a user-scoped socket path.
+func (d *DockerRuntime) isVM() bool {
+	host := d.client.DaemonHost()
+	if strings.HasPrefix(host, "unix://") {
+		socketPath := strings.TrimPrefix(host, "unix://")
+		// Check for known VM-based Docker socket locations
+		home, _ := os.UserHomeDir()
+		vmSockets := []string{
+			filepath.Join(home, ".colima", "default", "docker.sock"),
+			filepath.Join(home, ".colima", "docker.sock"),
+			filepath.Join(home, ".orbstack", "run", "docker.sock"),
+		}
+		for _, vmSock := range vmSockets {
+			if socketPath == vmSock {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // SocketPath returns the daemon-visible Unix socket path to bind-mount into
 // containers so LocalStack can launch nested workloads such as Lambda functions.
-// Even when the CLI connects through a user-scoped socket (for example Colima),
-// the daemon resolves bind mounts inside its own environment where the socket is
-// exposed at /var/run/docker.sock.
+// For VM-based Docker (Colima, OrbStack) returns /var/run/docker.sock as the
+// socket is remapped inside the VM. For rootless or custom setups, returns the
+// actual socket path extracted from the daemon host.
 func (d *DockerRuntime) SocketPath() string {
 	host := d.client.DaemonHost()
 	if strings.HasPrefix(host, "unix://") {
-		return "/var/run/docker.sock"
+		if d.isVM() {
+			return "/var/run/docker.sock"
+		}
+		return strings.TrimPrefix(host, "unix://")
 	}
 	return ""
 }

internal/runtime/docker_test.go

@@ -51,14 +51,14 @@ func TestSocketPath_ExtractsUnixPath(t *testing.T) {
 		cli, err := client.NewClientWithOpts(client.WithHost("unix:///home/user/.colima/default/docker.sock"))
 		require.NoError(t, err)
 		rt := &DockerRuntime{client: cli}
-		assert.Equal(t, "/var/run/docker.sock", rt.SocketPath())
+		assert.Equal(t, "/home/user/.colima/default/docker.sock", rt.SocketPath())
 	})
 
 	t.Run("orbstack socket returns daemon path", func(t *testing.T) {
 		cli, err := client.NewClientWithOpts(client.WithHost("unix:///Users/user/.orbstack/run/docker.sock"))
 		require.NoError(t, err)
 		rt := &DockerRuntime{client: cli}
-		assert.Equal(t, "/var/run/docker.sock", rt.SocketPath())
+		assert.Equal(t, "/Users/user/.orbstack/run/docker.sock", rt.SocketPath())
 	})
 }
 
@@ -69,3 +69,48 @@ func TestSocketPath_ReturnsEmptyForTCPHost(t *testing.T) {
 
 	assert.Equal(t, "", rt.SocketPath())
 }
+
+func TestSocketPath_VMDetection(t *testing.T) {
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
+
+	t.Run("colima socket exists returns remapped path", func(t *testing.T) {
+		colimaSock := filepath.Join(home, ".colima", "default", "docker.sock")
+		require.NoError(t, os.MkdirAll(filepath.Dir(colimaSock), 0o755))
+		f, err := os.Create(colimaSock)
+		require.NoError(t, err)
+		f.Close()
+		defer os.Remove(colimaSock)
+
+		cli, err := client.NewClientWithOpts(client.WithHost("unix://" + colimaSock))
+		require.NoError(t, err)
+		rt := &DockerRuntime{client: cli}
+		assert.Equal(t, "/var/run/docker.sock", rt.SocketPath())
+	})
+
+	t.Run("orbstack socket exists returns remapped path", func(t *testing.T) {
+		orbstackSock := filepath.Join(home, ".orbstack", "run", "docker.sock")
+		require.NoError(t, os.MkdirAll(filepath.Dir(orbstackSock), 0o755))
+		f, err := os.Create(orbstackSock)
+		require.NoError(t, err)
+		f.Close()
+		defer os.Remove(orbstackSock)
+
+		cli, err := client.NewClientWithOpts(client.WithHost("unix://" + orbstackSock))
+		require.NoError(t, err)
+		rt := &DockerRuntime{client: cli}
+		assert.Equal(t, "/var/run/docker.sock", rt.SocketPath())
+	})
+
+	t.Run("rootless socket exists returns actual path", func(t *testing.T) {
+		// Use a non-VM socket path (short path to avoid Docker client limit)
+		rootlessSock := "/tmp/lstk-docker.sock"
+		require.NoError(t, os.WriteFile(rootlessSock, nil, 0o600))
+		defer os.Remove(rootlessSock)
+
+		cli, err := client.NewClientWithOpts(client.WithHost("unix://" + rootlessSock))
+		require.NoError(t, err)
+		rt := &DockerRuntime{client: cli}
+		assert.Equal(t, rootlessSock, rt.SocketPath())
+	})
+}