Backport of the docker group removal (PR #8056, merged to quattro as b5ded31e)
onto the v4-0-1 release branch.
The docker group is root-equivalent: anything in it can docker run -v /:/host
and rewrite the host as root with no password. On a single-user box that is not
an escalation -- the owner is already a wheel user -- but it hands any code
running as the user, a rogue plugin or a poisoned dependency, a silent,
headless, passwordless path to root that sudo's password prompt would otherwise
gate.
Stop granting the group by default. The daemon still runs, the Docker TUI and
the Windows VM reach it through a polkit prompt, and the plain docker CLI runs
under sudo. Sudoless Docker becomes a warned opt-in under Setup > Security, and
no automatic path re-grants it: install and first-boot provisioning never record
or apply the group, and the Quattro upgrade no longer adds it. A migration takes
existing installs out of the group, reusing omarchy-remove-security-sudoless-
docker so the change and its notice have one source of truth.
The Windows VM keeps needing the root daemon for a privileged container, so it
runs without the group without becoming a new way in: the compose moves to a
root-owned directory written only by an elevated, input-validated writer, volume
paths are rebuilt from $HOME on migration rather than trusted from the
user-writable legacy file, the privileged sub-action is checked against an
allowlist before dispatch, pkexec elevates a verified root-owned command path,
mount sources are refused when they are or resolve through a symlink, and the
guest password moves to a private 0600 per-user file instead of a
world-readable compose. Existing installs auto-migrate the VM without a
redownload.
Two files had diverged from quattro and were resolved by hand:
bin/omarchy-windows-vm -- v4-0-1 still carries the "Starting Windows VM" toast
that #7585 dropped on quattro, and the new start path has no user-side status
check to hang it on: after this change the user cannot inspect the container
without privilege, which is the whole point. Took quattro's version. #7585's
reason holds here too -- the shell shows its own "Launching Windows…" OSD until
the RDP window appears (shell/services/AppLibrary.qml) -- and the failure
notification stays. The file is now byte-identical to quattro.
manual/28-windows-vm.md -- took the new paragraph on the root-owned compose,
without the neighbouring OEM-key paragraph, which documents omarchy windows key,
a command quattro has and this branch does not.
test/shell passes here: 186 files, including the three this adds.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
Drops the ChatGPT web app from the default set at the same time, so installing
the openai-codex-desktop package can't leave two identical-looking ChatGPT
entries in the launcher. Super + Shift + A still opens the web version, which
is the only place it was really used.
The bundled ChatGPT icon stays: the package's own chatgpt.desktop asks for
Icon=chatgpt and ships no hicolor icon of its own.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.
* Agents should use the notification helper
* Turn a single RetroArch game into its own application launcher
* Tweak installer
* Extract selection logic into cli
* Use consistent glyph
* One more
Solves the issue from ae10133b5e the right
way using the actual xdg-terminal-exec package and provides resillient
fallbacks no matter what the user might do.
This also removes the need to restart after changing terminals at all.
fixes#2198fixes#2329fixes#2673fixes#1754
* adding TUI for starting up windows VM
* updating to use docker-compose
* adding possibility to set windows product-key
* ram and cpu settings
* first time run notes
* add two needed pacman packages
* key and package install
* Revert "add two needed pacman packages"
This reverts commit 04dc96cee0d3e37103b9866d9140ba47133db7ad.
* add install and remove scripts
* install icon
* rename scripts and menu to Windows VM
* rename also launch script to windows vm
* update nameing
* remove quotes
* fix paramter and quiting after installation
* fix launch script
* update
* certificate acceptance and remove of desktop app
* move desktop app
* rename app from "Windows VM" to "Windows"
* add example of sharing local share with Windows
* merge 'dev' into windows-docker-vm
* exchange rdesktop with freerdc
* accept certificates automatically so user don't fail first try
* remove certi during normal launch (handled in install process)
* remove volumes and orphans to have clean state (avoids hang on login)
* /cert option still needed
* Simplify package installs
* Fix icon + desktop to prevent creation on initial install
* omarchy-windows-vm in working form
* Don't need this anymore
* Fix commands
* Always use uwsm-app
* We are generating it instead
* Make omarchy-pkg-add quiet when the packages are already there
* Improve the questionnaire
* Show where you change resource usage
* Add default Windows share
---------
Co-authored-by: sspaeti <simon@ssp.sh>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* update to use $TERMINAL instead of alacitty
* revert
* move env to hyprconfig
* Only set if we have alacritty
* Add launcher for wifi settings so it can be used in mako config
* Set system terminal in config/uwsm/env to ensure its available everywhere
* Ensure that $TERMINAL is available after update
* Didn't work to have the TERMINAL env in Hyprland
* Configure terminal settings against a full set of options
* Make About usable with any terminal
* One more alacritty-specific setting
* Use the new wifi launcher bin
* Only require the update/relaunch if TERMINAL isn't already set in config/uwsm/env
* More alacritty usage converted to $TERMINAL
* Use new launcher
* Change scrolltouchpad input rule to apply to all terminals
* Its a singular match
* Take current font from waybar, in case we don't have alacritty
* Only set font for alacritty if its being used
* Get ready to be terminal agnostic on the refresh of config too
* Use new launcher
* Note the last reliance we have on alacritty
* Make theme setting for terminals generic and include kitty
* Set font_family for kitty as well
* Quiet grep
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Feed the image folder to the Image Viewer so the next/previous image navigation works
When double clicking an image in Nautilus, my expectation is that I can navigate to the other images in the folder with the arrow keys.
This doesn't happen currently because the imv command receives only the filename as a parameter.
However, if we use:
`imv -n /myfolder/image.jpg /myfolder`
works becasue we're opening the folder starting at the image given by the -n parameter.
* add migration for imv.desktop update
* Simplify migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Change lazyvim and asdcontrol to packages
* Remove asdcontrol and lazyvim
* Add lazyvim setup
* Don't trigger rebuild. We already rebuild later.
* Add new pacman.conf after install
* Update config to keep mirrors in mirrorlist
* Add lazyvim setup back
* Make webapp installer work with local images
* Update tuis to work offline
* Update pacman config situation
* Extract the reboot segment into its own file
* Explainer
* Can't return in executed scripts
* Add post-install
* Extract the reboot segment into its own file
* Fix rebase doubling up
* Add run wrapper function for feedback
* Redirect output to log
* Move gnome updates to first-run
* Add theme to first-run
* Updat to try to get logging working
* Create the file and give permissions
* Test gsettings
* Revert "Test gsettings"
This reverts commit 49c27d319407f6c95fcbb4c5a2646e54b50c9ab4.
* Stop logging
* Add time outputs to end of logs
* Rearrange some scripts to cleanup
* Cleanup
* Add timing to run script
* Don't enable multilib for offline
* Add prebuild ruby
* Try spinner setup
* Prevent exit 1 due to grep not matching
* Update limine config to work for USB installs as well
* Add offline install to env report
* Fix grep pipefailure
* Update logs exports to work with subshells
* Fix backward logic
* Attempt to fix logging again
* Export chrootable for subshells
* Clean up outputs
* Move chrootable up
* Source chroot instead
* Changes for logging
* Center up reboot notice
* Update fixed paths
* Update trap
* Revert reverting precompiled ruby due to issues
* Revert "Revert reverting precompiled ruby due to issues"
This reverts commit c159e7dc51cfdd2fb750c49c66bc4468e1208446.
* Remove junk to cleanup fixed paths now that we have relative
* Add git branch check to transition beta to main
* Log output
* Add time output on summary screen
* We don't need sudo here
* Add ansi helpers to make code cleaner
* Add dry-run helpers for testing
* Split out some common / reused items
* Add log output function
* Use gum log to output cleaner
* Cleanup
* Update trap with options
* Fix reboot and pad it
* Cleanup
* Add dry-run for testing
* Use default $PADDING for gum
* More styles
* Styles and really exit
* Update to new format
* Add ansi vars
* Update log output to prevent flickering
* Fix logo exporting
* Trap updates
* Add exit handler
* Prevent double-trapping
* Update traps
* Consolidate logic
* Update reboot to work in chroot
* Eliminate double-guard
* Attempt to speed up by removing mkinitcpio hooks
* Add multilib for nvidia users
* Add back wireless-regdom
* Remove dryrun items
* Fix to be offline
* Set fonts for plymouth to solve freetype2 issue
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
* Update omarchy-refresh-plymouth to account for limine changes (#1575)
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update modes
* Remove direct executions of .sh files
* Add variable safety
* Add omarchy-upload-log
* Add broadcome fix for MBP
* Prevent printing on screen when rebooting
* Make packages list universal
* Rename
* Remove retry message
* Fix packages target
* Add system info to upload
* Update variable name
* Remove unnecessary executable statuses
* Remove gesture default
* Add bcm4360 fix to install
* Add useful debug info
* Add OMARCHY_PATH
* Only look locally offline
* Rename / rearrange files
* Export so they're available to subshells
* Update for alternate
* Rearrange
* Log install time if no arch
* Add limine to packages list
* Update comments
* Update sizing method
* Update mode switcher
* Move icons to be embedded in installer
* Set install mode to online
* shebang and sudo
* Remove deleted branch check
* Elim banners
* Elim verbosity
* Rename LOG_FILE
* Multilib on by default
* Flip to positive
* Switch to gnome-theme.sh for first run
* Elim ansi-codes helper
* Move guard up to be the first thing that's hit
* Extract a couple of functions
* Trim
* Trim
* Move back to trap
* Update to single gum file
* Just show total
* Pulled function to a helper
* Extract explaining function
* Use complete conditional flows where possible
* Reference variable close to its use
* Use modern bash conditional syntax
* Comment before function
* Use a simpler shared exit headline
Doesn't matter how we stopped, just that we did
* CRs
* Keep constants together
* Style on comment
* Explain QR Code
* Modern bash conditional and use lowercase for all local variables
* Use bash calculation syntax for numbers
* Use calculation syntax where possible
* cleanup was not intention revealing enough imo
* Spacing
* Retry won't produce something different in offline mode
* Not needed
* Use modern bash conditional style
* String-wrapping not needed in [[ ]]
* Might as well use constants for all of these
* Don't need the wrapping
* Move the output saving into where we're working with it
* Not needed as long as we just source this
* Gum is a helper
* Slim down logging setup
* Reflect broader scope of work
* Everything should live in file
* Simpler
* Ordering
* Style
* Better separation of concerns
* Stop pretending these are meant to run directly
* Move all packaging execution together
* No longer used in an offline centric setup
* None of these are directly executable any more either
* Modern bash conditional
* Better name
* Explain what's going on
* Use modern bash conditional
* Use modern bash styule
* No need for bashing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: DoppioJP <jakub@doppio.jp>
