Installing docker by default is completely insane. What are they doing? Rootless podman has been around for many years at this point.
Omarchy: Any User Process Can Escalate to Root
11–20 of 584 posts
Re: Omarchy: Any User Process Can Escalate to Root
#12OK... and? This doesn't matter for a desktop, because:
1. Having access to the user's home directory is way more serious than being able to install drivers or whatever
2. There are a million other ways to escalate to root by obtaining the user's password
I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to use someone's Arch setup?
Re: Omarchy: Any User Process Can Escalate to Root
#13Earlier quoted context omitted.
Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..
Come on. I am sure you don’t like DHH. But he’s always taken security seriously in Rails.
As I said, podman requires effort and thought on the user's side, as the rootless part incurs complexity. I do not think that this aligns with the omakase mantra of omarchy. I do not think that DHH does not take security seriously. I think that Omarchy is not meant to sacrifice devex for security.
Re: Omarchy: Any User Process Can Escalate to Root
#14Earlier quoted context omitted.
that's what I do and what the author recommends as well
Somehow I doubt DHH and company would be OK sacrificing ""developer experience"" for security... There is still a non-trivial amount of docker-compose files and Docker incantations that don't work 1:1 with podman and podman-compose. Adjusting them would require Omarchy's users underatanding podman, and I doubt this will align with the opinionated nature of Omarchy..
Omarchy is an agent first experience, no? just ask your agent!
Re: Omarchy: Any User Process Can Escalate to Root
#15It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
Re: Omarchy: Any User Process Can Escalate to Root
#16OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…
Re: Omarchy: Any User Process Can Escalate to Root
#17Lol. This misconfiguration is so common and so trivial that LLMs have been known to exploit it unprompted, to complete their task.
[flagged]
Re: Omarchy: Any User Process Can Escalate to Root
#18I was expecting a more sophisticated attack and then I scrolled down…
> Omarchy configured its default user as a member of the Linux docker group.
What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation.
https://docs.docker.com/engine/install/linux-postinstall/
Why would you want to make this the default for your users, without even telling them? Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro??? Makes you wonder how much other crap is there.
Re: Omarchy: Any User Process Can Escalate to Root
#19It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
>when it’s a very common setup to add regular user to the docker group.
As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.
Re: Omarchy: Any User Process Can Escalate to Root
#20Lol. This misconfiguration is so common and so trivial that LLMs have been known to exploit it unprompted, to complete their task.
[flagged]