feat: Add systemd socket proxy for backward compatibility

Instead of symlinks (which don't work with Docker bind mounts because
Docker resolves them to the target file's inode), use systemd socket
activation with systemd-socket-proxyd.

Key insight: systemd.socket creates and owns the socket file, not the
service process. This means:
- The socket file persists across proxy service restarts
- The inode never changes
- Containers that mount /var/run/dstack.sock directly will continue
  to work even after guest-agent restarts

Added:
- dstack-socket-compat.socket + .service: /var/run/dstack.sock proxy
- tappd-socket-compat.socket + .service: /var/run/tappd.sock proxy

Removed:
- Symlink creation in system_setup.rs (ineffective for this purpose)

Author: kvinwang

basefiles/dstack-socket-compat.service

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2024-2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Proxy service that forwards connections from /var/run/dstack.sock to /var/run/dstack/dstack.sock.
+# Used for backward compatibility with containers that mount the socket file directly.
+
+[Unit]
+Description=dstack socket proxy for backward compatibility
+Requires=dstack-socket-compat.socket
+After=dstack-guest-agent.service
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd /var/run/dstack/dstack.sock
+Type=notify

basefiles/dstack-socket-compat.socket

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2024-2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Backward compatibility socket for containers that mount /var/run/dstack.sock directly.
+# The socket is owned by systemd, so it survives service restarts without inode changes.
+
+[Unit]
+Description=dstack backward compatibility socket (dstack.sock)
+
+[Socket]
+ListenStream=/var/run/dstack.sock
+SocketMode=0777
+
+[Install]
+WantedBy=sockets.target

basefiles/tappd-socket-compat.service

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2024-2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Proxy service that forwards connections from /var/run/tappd.sock to /var/run/dstack/tappd.sock.
+# Used for backward compatibility with containers that mount the socket file directly.
+
+[Unit]
+Description=tappd socket proxy for backward compatibility
+Requires=tappd-socket-compat.socket
+After=dstack-guest-agent.service
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd /var/run/dstack/tappd.sock
+Type=notify

basefiles/tappd-socket-compat.socket

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2024-2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Backward compatibility socket for containers that mount /var/run/tappd.sock directly.
+# The socket is owned by systemd, so it survives service restarts without inode changes.
+
+[Unit]
+Description=dstack backward compatibility socket (tappd.sock)
+
+[Socket]
+ListenStream=/var/run/tappd.sock
+SocketMode=0777
+
+[Install]
+WantedBy=sockets.target

dstack-util/src/system_setup.rs

@@ -1465,17 +1465,11 @@ impl Stage1<'_> {
         Ok(())
     }
 
-    /// Setup socket directory and backward compatibility symlinks.
-    /// Creates /var/run/dstack/ directory and symlinks for old socket paths.
+    /// Setup socket directory for dstack-guest-agent.
     fn setup_socket_dir(&self) -> Result<()> {
-        info!("Setting up socket directory and backward compatibility symlinks");
+        info!("Setting up socket directory");
         cmd! {
-            // Create the new socket directory
             mkdir -p /var/run/dstack;
-            // Create backward compatibility symlinks (old path -> new path)
-            // These allow old containers that mount the file directly to still work
-            ln -sf /var/run/dstack/dstack.sock /var/run/dstack.sock;
-            ln -sf /var/run/dstack/tappd.sock /var/run/tappd.sock;
         }?;
         Ok(())
     }

sdk/curl/api-tappd.md

@@ -16,7 +16,7 @@ services:
       - /var/run/dstack:/var/run/dstack
 ```
 
-> **Note:** The old path `/var/run/tappd.sock` is still supported via symlink for backward compatibility.
+> **Note:** The old path `/var/run/tappd.sock` is still supported via systemd socket proxy for backward compatibility.
 
 ## Endpoints
 

sdk/curl/api.md

@@ -16,7 +16,7 @@ services:
       - /var/run/dstack:/var/run/dstack
 ```
 
-> **Note:** The old path `/var/run/dstack.sock` is still supported via symlink for backward compatibility.
+> **Note:** The old path `/var/run/dstack.sock` is still supported via systemd socket proxy for backward compatibility.
 
 ## Endpoints