* Don't put the user in the docker group; make it opt-in
The docker group is root-equivalent: anything in it can `docker run -v /:/host`
and rewrite the host as root with no password. On a single-user box that's not
an escalation (the owner is already a wheel/sudo user), but it hands any code
running as the user — a rogue plugin, a poisoned dependency — a silent, headless,
passwordless path to root that sudo's password prompt would otherwise gate.
Stop granting the docker group by default. The daemon still runs (docker.socket);
the Docker TUI and the Windows VM reach it through a polkit prompt, and the plain
`docker` CLI runs under sudo. Sudoless Docker is a warned opt-in via
Setup > Security (omarchy-setup-security-sudoless-docker).
No automatic path may re-grant it: install and first-boot provisioning never
record or apply the group (provisioning also filters a docker line left in an
older factory snapshot), and the Quattro upgrade no longer adds it.
The Windows VM keeps needing the root daemon for a privileged container (KVM,
NET_ADMIN), so it is reworked to run without the group and without becoming a new
way in:
- The compose lives in a root-owned dir and is only written by an elevated,
input-validated writer. A root-invoked bring-up must never consume a file a
user-process could rewrite to bind-mount / into the guest — the old
~/.config/windows compose was exactly that. Volume paths are rebuilt from
$HOME on migration rather than trusted from the (user-writable) legacy file,
path validation rejects traversal, and the privileged sub-action is checked
against an allowlist before dispatch (a slash in it would otherwise run as a
path).
- pkexec elevates a verified root-owned command path, not a PATH-resolved one,
so an authorized prompt can't be redirected to an attacker's binary.
- The guest password is kept in a private 0600 per-user file for RDP instead of
a world-readable compose, and a declined authorization is reported as such,
never as a completed stop.
Existing installs auto-migrate the VM (no redownload) and refresh the stale
Docker launcher entry.
🤖 Generated by Opus 4.8 in Claude Code. Reviewed by Codex XHigh.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Codex XHigh <codex@openai.com>
Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T
* Migrate existing installs off the docker group
The default flip only reaches new installs; existing users keep their docker
group membership and stay exposed. Extend the migration that already refreshes
the Docker launcher to also remove the current user from the group when present,
reusing omarchy-remove-security-sudoless-docker so there is one source of truth
for the change and its notice. It takes effect at next login (the current
session keeps working), and passwordless docker can be turned back on from
Setup > Security > Sudoless Docker.
Migrations run with sudo available — during `omarchy update`, or in the terminal
the pending-migrations notification opens — so the privileged removal does not
prompt at an unattended login. The no-op path (already out of the group) needs
no privilege.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T
* Refuse symlinked VM mount sources; correct the docker CLI docs
Review follow-ups.
valid_path keeps a traversal string (/./, //, ..) out of the compose, but it is
a string check: a symlink planted at ~/.windows or ~/Windows redirects the
privileged bind mount exactly as traversal would, because docker follows it. So
verify the mount sources as root immediately before bringing the VM up — refuse
a source that is a symlink or resolves through one — which is where the string
check cannot help. A missing source stays fine (docker creates a plain dir).
Also correct the development-tools manual: the CLI is not transparently elevated
(there is no docker wrapper and `d` is still plain docker), so say plainly that
docker on the command line takes `sudo` until sudoless Docker is enabled.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Codex XHigh <codex@openai.com>
Drops the ChatGPT web app from the default set at the same time, so installing
the openai-codex-desktop package can't leave two identical-looking ChatGPT
entries in the launcher. Super + Shift + A still opens the web version, which
is the only place it was really used.
The bundled ChatGPT icon stays: the package's own chatgpt.desktop asks for
Icon=chatgpt and ships no hicolor icon of its own.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove legacy online installer entrypoints, collapse migrations for 4.0, and move setup responsibilities into target-side system, hardware, and user commands.
* Agents should use the notification helper
* Turn a single RetroArch game into its own application launcher
* Tweak installer
* Extract selection logic into cli
* Use consistent glyph
* One more
Solves the issue from ae10133b5e the right
way using the actual xdg-terminal-exec package and provides resillient
fallbacks no matter what the user might do.
This also removes the need to restart after changing terminals at all.
fixes#2198fixes#2329fixes#2673fixes#1754
* adding TUI for starting up windows VM
* updating to use docker-compose
* adding possibility to set windows product-key
* ram and cpu settings
* first time run notes
* add two needed pacman packages
* key and package install
* Revert "add two needed pacman packages"
This reverts commit 04dc96cee0d3e37103b9866d9140ba47133db7ad.
* add install and remove scripts
* install icon
* rename scripts and menu to Windows VM
* rename also launch script to windows vm
* update nameing
* remove quotes
* fix paramter and quiting after installation
* fix launch script
* update
* certificate acceptance and remove of desktop app
* move desktop app
* rename app from "Windows VM" to "Windows"
* add example of sharing local share with Windows
* merge 'dev' into windows-docker-vm
* exchange rdesktop with freerdc
* accept certificates automatically so user don't fail first try
* remove certi during normal launch (handled in install process)
* remove volumes and orphans to have clean state (avoids hang on login)
* /cert option still needed
* Simplify package installs
* Fix icon + desktop to prevent creation on initial install
* omarchy-windows-vm in working form
* Don't need this anymore
* Fix commands
* Always use uwsm-app
* We are generating it instead
* Make omarchy-pkg-add quiet when the packages are already there
* Improve the questionnaire
* Show where you change resource usage
* Add default Windows share
---------
Co-authored-by: sspaeti <simon@ssp.sh>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* update to use $TERMINAL instead of alacitty
* revert
* move env to hyprconfig
* Only set if we have alacritty
* Add launcher for wifi settings so it can be used in mako config
* Set system terminal in config/uwsm/env to ensure its available everywhere
* Ensure that $TERMINAL is available after update
* Didn't work to have the TERMINAL env in Hyprland
* Configure terminal settings against a full set of options
* Make About usable with any terminal
* One more alacritty-specific setting
* Use the new wifi launcher bin
* Only require the update/relaunch if TERMINAL isn't already set in config/uwsm/env
* More alacritty usage converted to $TERMINAL
* Use new launcher
* Change scrolltouchpad input rule to apply to all terminals
* Its a singular match
* Take current font from waybar, in case we don't have alacritty
* Only set font for alacritty if its being used
* Get ready to be terminal agnostic on the refresh of config too
* Use new launcher
* Note the last reliance we have on alacritty
* Make theme setting for terminals generic and include kitty
* Set font_family for kitty as well
* Quiet grep
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Feed the image folder to the Image Viewer so the next/previous image navigation works
When double clicking an image in Nautilus, my expectation is that I can navigate to the other images in the folder with the arrow keys.
This doesn't happen currently because the imv command receives only the filename as a parameter.
However, if we use:
`imv -n /myfolder/image.jpg /myfolder`
works becasue we're opening the folder starting at the image given by the -n parameter.
* add migration for imv.desktop update
* Simplify migration
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Change lazyvim and asdcontrol to packages
* Remove asdcontrol and lazyvim
* Add lazyvim setup
* Don't trigger rebuild. We already rebuild later.
* Add new pacman.conf after install
* Update config to keep mirrors in mirrorlist
* Add lazyvim setup back
* Make webapp installer work with local images
* Update tuis to work offline
* Update pacman config situation
* Extract the reboot segment into its own file
* Explainer
* Can't return in executed scripts
* Add post-install
* Extract the reboot segment into its own file
* Fix rebase doubling up
* Add run wrapper function for feedback
* Redirect output to log
* Move gnome updates to first-run
* Add theme to first-run
* Updat to try to get logging working
* Create the file and give permissions
* Test gsettings
* Revert "Test gsettings"
This reverts commit 49c27d319407f6c95fcbb4c5a2646e54b50c9ab4.
* Stop logging
* Add time outputs to end of logs
* Rearrange some scripts to cleanup
* Cleanup
* Add timing to run script
* Don't enable multilib for offline
* Add prebuild ruby
* Try spinner setup
* Prevent exit 1 due to grep not matching
* Update limine config to work for USB installs as well
* Add offline install to env report
* Fix grep pipefailure
* Update logs exports to work with subshells
* Fix backward logic
* Attempt to fix logging again
* Export chrootable for subshells
* Clean up outputs
* Move chrootable up
* Source chroot instead
* Changes for logging
* Center up reboot notice
* Update fixed paths
* Update trap
* Revert reverting precompiled ruby due to issues
* Revert "Revert reverting precompiled ruby due to issues"
This reverts commit c159e7dc51cfdd2fb750c49c66bc4468e1208446.
* Remove junk to cleanup fixed paths now that we have relative
* Add git branch check to transition beta to main
* Log output
* Add time output on summary screen
* We don't need sudo here
* Add ansi helpers to make code cleaner
* Add dry-run helpers for testing
* Split out some common / reused items
* Add log output function
* Use gum log to output cleaner
* Cleanup
* Update trap with options
* Fix reboot and pad it
* Cleanup
* Add dry-run for testing
* Use default $PADDING for gum
* More styles
* Styles and really exit
* Update to new format
* Add ansi vars
* Update log output to prevent flickering
* Fix logo exporting
* Trap updates
* Add exit handler
* Prevent double-trapping
* Update traps
* Consolidate logic
* Update reboot to work in chroot
* Eliminate double-guard
* Attempt to speed up by removing mkinitcpio hooks
* Add multilib for nvidia users
* Add back wireless-regdom
* Remove dryrun items
* Fix to be offline
* Set fonts for plymouth to solve freetype2 issue
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
* Update omarchy-refresh-plymouth to account for limine changes (#1575)
* Required -y to run
* Update omarchy-refresh-plymouth to account for limine changes
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
* Update modes
* Remove direct executions of .sh files
* Add variable safety
* Add omarchy-upload-log
* Add broadcome fix for MBP
* Prevent printing on screen when rebooting
* Make packages list universal
* Rename
* Remove retry message
* Fix packages target
* Add system info to upload
* Update variable name
* Remove unnecessary executable statuses
* Remove gesture default
* Add bcm4360 fix to install
* Add useful debug info
* Add OMARCHY_PATH
* Only look locally offline
* Rename / rearrange files
* Export so they're available to subshells
* Update for alternate
* Rearrange
* Log install time if no arch
* Add limine to packages list
* Update comments
* Update sizing method
* Update mode switcher
* Move icons to be embedded in installer
* Set install mode to online
* shebang and sudo
* Remove deleted branch check
* Elim banners
* Elim verbosity
* Rename LOG_FILE
* Multilib on by default
* Flip to positive
* Switch to gnome-theme.sh for first run
* Elim ansi-codes helper
* Move guard up to be the first thing that's hit
* Extract a couple of functions
* Trim
* Trim
* Move back to trap
* Update to single gum file
* Just show total
* Pulled function to a helper
* Extract explaining function
* Use complete conditional flows where possible
* Reference variable close to its use
* Use modern bash conditional syntax
* Comment before function
* Use a simpler shared exit headline
Doesn't matter how we stopped, just that we did
* CRs
* Keep constants together
* Style on comment
* Explain QR Code
* Modern bash conditional and use lowercase for all local variables
* Use bash calculation syntax for numbers
* Use calculation syntax where possible
* cleanup was not intention revealing enough imo
* Spacing
* Retry won't produce something different in offline mode
* Not needed
* Use modern bash conditional style
* String-wrapping not needed in [[ ]]
* Might as well use constants for all of these
* Don't need the wrapping
* Move the output saving into where we're working with it
* Not needed as long as we just source this
* Gum is a helper
* Slim down logging setup
* Reflect broader scope of work
* Everything should live in file
* Simpler
* Ordering
* Style
* Better separation of concerns
* Stop pretending these are meant to run directly
* Move all packaging execution together
* No longer used in an offline centric setup
* None of these are directly executable any more either
* Modern bash conditional
* Better name
* Explain what's going on
* Use modern bash conditional
* Use modern bash styule
* No need for bashing
---------
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: DoppioJP <jakub@doppio.jp>
