OmarchybotandClaude Opus 5
7b89780810
Backport of the reboot flag (PR #8080, merged to quattro as 1565919c) onto the
v4-0-1 release branch, on top of the #8056 backport it follows.
Group membership is fixed at login, so removing (or adding) the docker group
does not take effect in the running session. The existing-user migration and the
Setup > Security toggles now call omarchy-state set reboot-required, so
omarchy-update-restart prompts for the reboot that actually applies the change
and the bar shows it pending. A plain log out and back in still works.
The migration test now exercises the real removal command and omarchy-state
rather than a stub, asserting the reboot flag is set on removal and left alone
when the user is already out of the group.
Clean cherry-pick on top of the #8056 backport: all three files are
byte-identical to quattro, so merging v4-0-1 into quattro resolves without a
conflict. omarchy-state and omarchy-update-restart are unchanged on this branch
and read the same ~/.local/state/omarchy/reboot-required marker. test/shell
passes: 186 files.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
42 lines
1.7 KiB
Bash
Executable File
42 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Enable sudoless Docker by adding your user to the docker group (root-equivalent!)
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
if id -nG "$USER" 2>/dev/null | grep -qw docker; then
|
|
echo "Sudoless Docker is already enabled: $USER is in the docker group."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
exit 0
|
|
fi
|
|
|
|
echo ""
|
|
echo "⚠️ WARNING: Enabling sudoless Docker adds you to the 'docker' group."
|
|
echo ""
|
|
echo "The Docker daemon runs as root, so membership in the docker group is"
|
|
echo "equivalent to passwordless root. Any process running as your user could"
|
|
echo "then run, for example:"
|
|
echo ""
|
|
echo " docker run -v /:/host alpine # full read/write of the host, as root"
|
|
echo ""
|
|
echo "and take over the machine with no password prompt. A single rogue script,"
|
|
echo "dependency, or plugin running as you is enough. It is convenient for"
|
|
echo "development, but it removes the protection Omarchy keeps by default, where"
|
|
echo "Docker access goes through a polkit/sudo prompt."
|
|
echo ""
|
|
|
|
if gum confirm "Enable sudoless Docker? This gives anything running as you passwordless root."; then
|
|
sudo usermod -aG docker "$USER"
|
|
# Group membership is fixed at login, so docker won't be reachable without a
|
|
# prompt until the session restarts. Flag a reboot so omarchy-update-restart
|
|
# prompts for one (and the bar shows it pending).
|
|
omarchy-state set reboot-required
|
|
echo ""
|
|
echo "Sudoless Docker ENABLED. Reboot, or log out and back in (or run 'newgrp docker'),"
|
|
echo "for the new group membership to take effect."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
else
|
|
echo "Aborted. No changes made. Docker access still goes through a prompt."
|
|
fi
|