From 6b5ce68f25129d1352b2bc65f47d713ea5aa8a57 Mon Sep 17 00:00:00 2001
From: Ryan Hughes <ryan@heyoodle.com>
Date: Sun, 30 Aug 2026 14:19:21 -0400
Subject: [PATCH] Run docker through sudo when the socket refuses the user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The docker group is root-equivalent, so Omarchy operators stay out of
it on purpose — which left omarchy-iso-make unable to reach the daemon
at all. Fall back to sudo docker when a plain client call cannot reach
the socket; the script already prompts for interactive sudo elsewhere.
DOCKER_ARGS (including HOST_UID/HOST_GID) are assembled before the
escalation, so output ownership is unchanged.
---
 bin/omarchy-iso-make | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/bin/omarchy-iso-make b/bin/omarchy-iso-make
index e8195b4..5dbbeff 100755
--- a/bin/omarchy-iso-make
+++ b/bin/omarchy-iso-make
@@ -158,7 +158,15 @@ else
   DOCKER_ARGS+=(--pull=always)
 fi
 
-docker run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
+# The docker group is root-equivalent, so Omarchy operators stay out of it on
+# purpose. When the socket refuses the calling user, run the client through
+# sudo instead of requiring group membership.
+DOCKER=(docker)
+if ! docker version &>/dev/null; then
+  DOCKER=(sudo docker)
+fi
+
+"${DOCKER[@]}" run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
 
 latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*.iso | head -n1)
 iso_ref="${latest_iso%.*}-$OMARCHY_ISO_REF.iso"