OmarchybotandClaude Opus 5
c7af36d0aa
Backport of the sudoless Docker follow-up (PR #8098, merged to quattro as
06a3dbca) onto the v4-0-1 release branch, on top of the #8056 and #8080
backports it follows.
Group membership only takes effect on a fresh session, and in practice a logout
or newgrp is not enough -- only a reboot reliably applies it. The setup and
remove commands now flag the reboot and offer to do it right away with a gum
confirm, the same shape as the GPU toggle, and their notices say "after a
reboot" instead of pointing at logout or newgrp. The existing-user migration
reuses the removal command inside omarchy update, so it passes
OMARCHY_DEFER_REBOOT to skip the prompt there and lets omarchy-update-restart
handle the reboot once the whole update has finished.
Setup > Security showed Sudoless Docker under both Setup and Remove, and the
guards tested the running session's groups, which do not change until the
reboot: after enabling sudoless Docker the menu still offered Setup, the one
action that could no longer do anything, while Remove stayed hidden. Add
omarchy-sudo-docker as the single answer to both questions that differ in that
window -- by default whether this session can reach the socket, which is what
decides if a command must elevate, and with --configured whether the account is
set up for it, which is what the menu and the toggles need. It succeeds when
sudo is needed, so the Setup entry appears while sudoless Docker is off and
Remove once it is on. lazydocker and the Windows VM keep prompting until the
reboot lands.
Clean cherry-pick on top of the earlier backports: every file is byte-identical
to quattro except default/omarchy/omarchy-menu.jsonc, which merged into this
branch's menu and whose two Sudoless Docker lines match quattro exactly.
test/shell passes: 188 files, including the two this adds. test/cli passes, so
the new command's metadata is well-formed. Exercised the helper here: with no
socket it reports sudo is needed, and --configured answers from the account's
groups.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV
23 lines
1.2 KiB
Bash
23 lines
1.2 KiB
Bash
echo "Move this install to the opt-in docker group default (the group is root-equivalent)"
|
|
|
|
# The docker group grants passwordless root (a container can bind-mount / and
|
|
# rewrite the host), so Omarchy no longer puts users in it by default. Bring
|
|
# existing installs in line: remove this user from the group if present. The
|
|
# change applies after a reboot, so it stays reachable until then. Anyone who
|
|
# wants passwordless docker back can opt in, behind a warning, with
|
|
# Setup > Security > Sudoless Docker. Reuses the removal command so there is one
|
|
# source of truth for the privileged change and its notice; DEFER_REBOOT keeps
|
|
# it from prompting mid-update — omarchy-update-restart handles the reboot once
|
|
# the whole update has finished.
|
|
if id -nG "$USER" | grep -qw docker; then
|
|
OMARCHY_DEFER_REBOOT=1 omarchy-remove-security-sudoless-docker
|
|
fi
|
|
|
|
# The Docker app entry copied into ~/.local/share/applications used to run
|
|
# lazydocker directly; it now needs the wrapper that prompts for daemon access
|
|
# (or runs directly under sudoless Docker). Refresh just that file.
|
|
dest="$HOME/.local/share/applications/Docker.desktop"
|
|
if [[ -f $dest ]]; then
|
|
cp "$OMARCHY_PATH/applications/Docker.desktop" "$dest"
|
|
fi
|