OmarchybotandClaude Opus 5
c7af36d0aa
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
45 lines
1.8 KiB
Bash
Executable File
45 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Succeed when Docker needs sudo, fail when it can be used directly
|
|
# omarchy:args=[--configured]
|
|
# omarchy:examples=omarchy-sudo-docker && echo "needs sudo" | omarchy-sudo-docker --configured
|
|
# omarchy:hidden=true
|
|
|
|
# The docker group is root-equivalent, so Omarchy leaves users out of it by
|
|
# default and reaches the daemon through a prompt instead. Everything that has
|
|
# to make that choice asks here rather than testing group membership itself.
|
|
#
|
|
# Two questions, because they have different answers between toggling sudoless
|
|
# Docker and the reboot that applies it (group membership is fixed when the
|
|
# session is created):
|
|
#
|
|
# (default) Does Docker need sudo *right now*? Answered by whether this
|
|
# process can actually reach the socket, which is what decides
|
|
# if a command must elevate. Still true in the window after
|
|
# sudoless Docker is enabled but before the reboot.
|
|
# --configured Will it need sudo once the account's groups take effect?
|
|
# Answered from the account's configured groups, so the menu
|
|
# offers the toggle that can actually change state.
|
|
#
|
|
# Succeeds (exit 0) when sudo is needed, so it reads as `if omarchy-sudo-docker`.
|
|
|
|
DOCKER_SOCKET="${OMARCHY_DOCKER_SOCKET:-/var/run/docker.sock}"
|
|
|
|
case "${1:-}" in
|
|
--configured)
|
|
# An account in the docker group will not need sudo after the next login.
|
|
id -nG "$USER" 2>/dev/null | grep -qw docker && exit 1
|
|
exit 0
|
|
;;
|
|
"")
|
|
# A socket we can write is a daemon we can drive without elevating. A missing
|
|
# socket counts as needing sudo: reaching it means starting it as root anyway.
|
|
[[ -w $DOCKER_SOCKET ]] && exit 1
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Usage: omarchy-sudo-docker [--configured]" >&2
|
|
exit 2
|
|
;;
|
|
esac
|