refactor: cleanup Corrosion container on reset, move admin socket to runtime dir

internal/machine/corroservice/config.go

@@ -60,11 +60,12 @@ func (c *Config) Write(path, owner string) error {
 	return nil
 }
 
-func MkDataDir(dir, owner string) error {
+// MkDir creates a data or runtime directory for the Corrosion service with 0700 permissions and the specified owner.
+func MkDir(dir, owner string) error {
 	parent, _ := filepath.Split(dir)
-	// Use 0711 for parent directories to allow `owner` to access its nested data directory.
+	// Use 0711 for parent directories to allow `owner` to access its nested directory.
 	if err := os.MkdirAll(parent, 0o711); err != nil {
-		return fmt.Errorf("create directory %q: %w", parent, err)
+		return fmt.Errorf("create directory '%s': %w", parent, err)
 	}
 	if err := os.Mkdir(dir, 0o700); err != nil {
 		if !os.IsExist(err) {

internal/machine/corroservice/docker.go

@@ -21,11 +21,14 @@ import (
 const Image = "ghcr.io/unlabs-dev/corrosion:2026.5.14"
 
 type DockerService struct {
-	Client  *client.Client
-	Image   string
-	Name    string
+	Client *client.Client
+	Image  string
+	Name   string
+	// DataDir holds the corrosion config, schema, and db files.
 	DataDir string
-	User    string
+	// RunDir holds ephemeral runtime state like the admin socket.
+	RunDir string
+	User   string
 }
 
 func (s *DockerService) Start(ctx context.Context) error {
@@ -89,6 +92,23 @@ func (s *DockerService) Restart(ctx context.Context) error {
 	return nil
 }
 
+// Cleanup gracefully stops and removes the Corrosion container.
+func (s *DockerService) Cleanup(ctx context.Context) error {
+	if err := s.Client.ContainerStop(ctx, s.Name, container.StopOptions{}); err != nil {
+		if errdefs.IsNotFound(err) {
+			return nil
+		}
+		return fmt.Errorf("stop container '%s': %w", s.Name, err)
+	}
+	if err := s.Client.ContainerRemove(ctx, s.Name, container.RemoveOptions{
+		RemoveVolumes: true,
+	}); err != nil {
+		return fmt.Errorf("remove container '%s': %w", s.Name, err)
+	}
+	slog.Debug("Corrosion container removed.", "name", s.Name)
+	return nil
+}
+
 func (s *DockerService) Running() bool {
 	c, err := s.Client.ContainerInspect(context.Background(), s.Name)
 	if err != nil {
@@ -115,13 +135,22 @@ func (s *DockerService) hostConfig() *container.HostConfig {
 		RestartPolicy: container.RestartPolicy{
 			Name: container.RestartPolicyUnlessStopped,
 		},
+		LogConfig: container.LogConfig{
+			Type: "local",
+		},
 		Mounts: []mount.Mount{
-			// Bind mount the data directory at the same path inside the container to simplify path handling.
+			// Bind mount the data and runtime directories at the same paths inside the container
+			// to simplify path handling.
 			{
 				Type:   mount.TypeBind,
 				Source: s.DataDir,
 				Target: s.DataDir,
 			},
+			{
+				Type:   mount.TypeBind,
+				Source: s.RunDir,
+				Target: s.RunDir,
+			},
 		},
 	}
 }

internal/machine/corroservice/service.go

@@ -16,6 +16,8 @@ type Service interface {
 	Start(ctx context.Context) error
 	Stop(ctx context.Context) error
 	Restart(ctx context.Context) error
+	// Cleanup tears down the underlying service resources.
+	Cleanup(ctx context.Context) error
 	Running() bool
 }