OmarchybotandClaude Opus 5
c7af36d0aa
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
35 lines
1.4 KiB
Bash
Executable File
35 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Disable sudoless Docker by removing your user from the docker group
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
# Ask about the configured groups, not this session's: right after enabling,
|
|
# sudoless Docker is on for the account even though the running session still
|
|
# needs a prompt, and this command is what turns it back off.
|
|
if omarchy-sudo-docker --configured; then
|
|
echo "Sudoless Docker is not enabled: $USER is not in the docker group."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Removing $USER from the docker group..."
|
|
sudo gpasswd -d "$USER" docker >/dev/null
|
|
|
|
# Group membership is only re-read by a fresh session, and in practice logging
|
|
# out or newgrp isn't enough — only a reboot reliably applies it. Record it so a
|
|
# later `omarchy update` still prompts (omarchy-update-restart reads this), then
|
|
# offer to do it now.
|
|
omarchy-state set reboot-required
|
|
|
|
echo ""
|
|
echo "Sudoless Docker DISABLED. Docker access goes through a polkit/sudo prompt"
|
|
echo "again: the Docker TUI (Super + Shift + D) and the Windows VM ask when they"
|
|
echo "need it, and the plain 'docker' CLI runs under sudo. It takes effect after a reboot."
|
|
echo ""
|
|
# The migration reuses this command during 'omarchy update' and defers the
|
|
# reboot to omarchy-update-restart, so it doesn't cut the update short.
|
|
if [[ -z ${OMARCHY_DEFER_REBOOT:-} ]] && gum confirm "Reboot now to apply?"; then
|
|
omarchy-system-reboot
|
|
fi
|