OmarchybotandClaude Opus 5
c7af36d0aa
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
21 lines
992 B
Bash
Executable File
21 lines
992 B
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Open the Docker TUI (lazydocker) with access to the Docker daemon
|
|
# omarchy:hidden=true
|
|
|
|
# By default the install user is NOT in the docker group: membership is
|
|
# root-equivalent (a container can bind-mount / and rewrite the host as root),
|
|
# so a single process running as the user could otherwise escalate to root with
|
|
# no prompt. lazydocker needs the root-owned Docker socket, so when the group is
|
|
# absent, gate that access behind a polkit prompt. If the user has opted into
|
|
# sudoless Docker (omarchy-setup-security-sudoless-docker), the socket is already
|
|
# reachable, so run lazydocker directly — omarchy-sudo-docker answers that for
|
|
# this session, so the prompt stays until the reboot that grants the group.
|
|
# pkexec sanitizes the environment, so carry TERM through for the TUI to render
|
|
# and run lazydocker from root's PATH.
|
|
if omarchy-sudo-docker; then
|
|
exec pkexec /usr/bin/env TERM="${TERM:-xterm-256color}" lazydocker
|
|
else
|
|
exec lazydocker
|
|
fi
|