OmarchybotandClaude Opus 5
c7af36d0aa
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
50 lines
2.1 KiB
Bash
Executable File
50 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Enable sudoless Docker by adding your user to the docker group (root-equivalent!)
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
# Ask about the configured groups, not this session's: once enabled it stays
|
|
# enabled for the account even before the reboot that lets this session use it.
|
|
if ! omarchy-sudo-docker --configured; then
|
|
echo "Sudoless Docker is already enabled: $USER is in the docker group."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
exit 0
|
|
fi
|
|
|
|
echo ""
|
|
echo "⚠️ WARNING: Enabling sudoless Docker adds you to the 'docker' group."
|
|
echo ""
|
|
echo "The Docker daemon runs as root, so membership in the docker group is"
|
|
echo "equivalent to passwordless root. Any process running as your user could"
|
|
echo "then run, for example:"
|
|
echo ""
|
|
echo " docker run -v /:/host alpine # full read/write of the host, as root"
|
|
echo ""
|
|
echo "and take over the machine with no password prompt. A single rogue script,"
|
|
echo "dependency, or plugin running as you is enough. It is convenient for"
|
|
echo "development, but it removes the protection Omarchy keeps by default, where"
|
|
echo "Docker access goes through a polkit/sudo prompt."
|
|
echo ""
|
|
|
|
if gum confirm "Enable sudoless Docker? This gives anything running as you passwordless root."; then
|
|
sudo usermod -aG docker "$USER"
|
|
# A new docker group membership is only picked up by a fresh session, and in
|
|
# practice logging out or newgrp isn't enough — only a reboot reliably applies
|
|
# it. Record it so a later `omarchy update` still prompts
|
|
# (omarchy-update-restart reads this), then offer to do it now.
|
|
omarchy-state set reboot-required
|
|
echo ""
|
|
echo "Sudoless Docker ENABLED. It takes effect after a reboot."
|
|
echo "To disable it again: Setup > Security > Sudoless Docker."
|
|
echo ""
|
|
# The migration reuses this command during 'omarchy update' and defers the
|
|
# reboot to omarchy-update-restart, so it doesn't cut the update short.
|
|
if [[ -z ${OMARCHY_DEFER_REBOOT:-} ]] && gum confirm "Reboot now to apply?"; then
|
|
omarchy-system-reboot
|
|
fi
|
|
else
|
|
echo "Aborted. No changes made. Docker access still goes through a prompt."
|
|
fi
|