Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.
The article specifically calls this out as a preferred option.
Omarchy: Any User Process Can Escalate to Root
21–30 of 583 posts
Re: Omarchy: Any User Process Can Escalate to Root
#22Is it not better to run a VM just for Docker, like we have to do on macOS?
That has all sorts of issues like eating disk space and RAM, because neither can't be released to the host once allocated, but then become unused.
Re: Omarchy: Any User Process Can Escalate to Root
#23It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
It is one thing to do things the risky way on your own system and another thing to ship an unsafe and unconventional default to your users.
Re: Omarchy: Any User Process Can Escalate to Root
#24I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does.
(example: NetworkChuck, Primeagen? and a few others)
also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it
Re: Omarchy: Any User Process Can Escalate to Root
#25Re: Omarchy: Any User Process Can Escalate to Root
#26I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…
Because it's convenient, and the security of this doesn't matter for desktop usage.
Re: Omarchy: Any User Process Can Escalate to Root
#27It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.
Adding your user to the docker group is in the official Docker install instructions, I wouldn't call that "random copy paste guides".
Re: Omarchy: Any User Process Can Escalate to Root
#28It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.
The methods are described on the official docker website, not just random blogs or SO pages. There are caveats about security, of course, but it's not truly discouraged.
Re: Omarchy: Any User Process Can Escalate to Root
#29Is it not better to run a VM just for Docker, like we have to do on macOS?
I just want to put this out there, smolmachines is a wonderful program to solve this, I use this mostly for stuff needing docker socket / docker in docker (example strix and agents). (I'm using podman on my host)
Re: Omarchy: Any User Process Can Escalate to Root
#30It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.
>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.
You mean, just how it is on Windows?