app-emulation/docker: restart on-failure

This also syncs a few other small changes from upstream.

See https://github.com/moby/moby/pull/30210 for the network-online
change / bugs references.

There doesn't appear to be a reason the socket's user differed from
upstream, so there's no intended meaning to that change beyond syncing
with upstream.

sdk_container/src/third_party/coreos-overlay/app-emulation/docker/files/docker.service

@@ -1,7 +1,8 @@
 [Unit]
 Description=Docker Application Container Engine
 Documentation=http://docs.docker.com
-After=containerd.service docker.socket network.target
+After=containerd.service docker.socket network-online.target
+Wants=network-online.target
 Requires=containerd.service docker.socket
 
 [Service]
@@ -24,6 +25,12 @@ TasksMax=infinity
 TimeoutStartSec=0
 # set delegate yes so that systemd does not reset the cgroups of docker containers
 Delegate=yes
+# kill only the docker process, not all processes in the cgroup
+KillMode=process
+# restart the docker process if it exits prematurely
+Restart=on-failure
+StartLimitBurst=3
+StartLimitInterval=60s
 
 [Install]
 WantedBy=multi-user.target

sdk_container/src/third_party/coreos-overlay/app-emulation/docker/files/docker.socket

@@ -5,7 +5,7 @@ PartOf=docker.service
 [Socket]
 ListenStream=/var/run/docker.sock
 SocketMode=0660
-SocketUser=docker
+SocketUser=root
 SocketGroup=docker
 
 [Install]