06a3dbca42
* Offer to reboot when toggling sudoless Docker; show only the relevant menu entry Group membership only takes effect on a fresh session, and in practice a logout or newgrp isn't enough — only a reboot reliably applies it. So the setup/remove commands now flag the reboot and offer to do it now with a gum confirm (like the GPU toggle), and the notices say "after a reboot" instead of pointing at logout or newgrp. The existing-user migration passes OMARCHY_DEFER_REBOOT so it does not prompt mid-update — omarchy-update-restart still handles the reboot once the whole update finishes. The Setup > Security menu also showed Sudoless Docker under both Setup and Remove. Condition the Setup entry on the group being absent (Remove already conditions on it being present), so only the applicable one appears. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T * Ask omarchy-sudo-docker whether Docker needs sudo Every place that chooses between talking to Docker directly and elevating was testing group membership by hand, and the menu guards tested the wrong thing: they read the running session's groups, which do not change until the reboot, so after enabling sudoless Docker the menu still offered Setup — the one action that could no longer do anything — while Remove stayed hidden. Add omarchy-sudo-docker as the single answer, with the two questions that actually differ in that window. By default it asks whether this session can reach the socket, which is what decides if a command must elevate: lazydocker and the Windows VM keep prompting until the reboot lands. With --configured it asks whether the account is set up for sudoless Docker, which is what the menu and the toggles need, so the menu switches to the action that can change state as soon as the group is written. Also correct a comment: nothing surfaces reboot-required in the bar; it is omarchy-update-restart that reads it during a later update. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T --------- Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
2.1 KiB
Bash
Executable File
50 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Enable sudoless Docker by adding your user to the docker group (root-equivalent!)
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
# Ask about the configured groups, not this session's: once enabled it stays
|
|
# enabled for the account even before the reboot that lets this session use it.
|
|
if ! omarchy-sudo-docker --configured; then
|
|
echo "Sudoless Docker is already enabled: $USER is in the docker group."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
exit 0
|
|
fi
|
|
|
|
echo ""
|
|
echo "⚠️ WARNING: Enabling sudoless Docker adds you to the 'docker' group."
|
|
echo ""
|
|
echo "The Docker daemon runs as root, so membership in the docker group is"
|
|
echo "equivalent to passwordless root. Any process running as your user could"
|
|
echo "then run, for example:"
|
|
echo ""
|
|
echo " docker run -v /:/host alpine # full read/write of the host, as root"
|
|
echo ""
|
|
echo "and take over the machine with no password prompt. A single rogue script,"
|
|
echo "dependency, or plugin running as you is enough. It is convenient for"
|
|
echo "development, but it removes the protection Omarchy keeps by default, where"
|
|
echo "Docker access goes through a polkit/sudo prompt."
|
|
echo ""
|
|
|
|
if gum confirm "Enable sudoless Docker? This gives anything running as you passwordless root."; then
|
|
sudo usermod -aG docker "$USER"
|
|
# A new docker group membership is only picked up by a fresh session, and in
|
|
# practice logging out or newgrp isn't enough — only a reboot reliably applies
|
|
# it. Record it so a later `omarchy update` still prompts
|
|
# (omarchy-update-restart reads this), then offer to do it now.
|
|
omarchy-state set reboot-required
|
|
echo ""
|
|
echo "Sudoless Docker ENABLED. It takes effect after a reboot."
|
|
echo "To disable it again: Setup > Security > Sudoless Docker."
|
|
echo ""
|
|
# The migration reuses this command during 'omarchy update' and defers the
|
|
# reboot to omarchy-update-restart, so it doesn't cut the update short.
|
|
if [[ -z ${OMARCHY_DEFER_REBOOT:-} ]] && gum confirm "Reboot now to apply?"; then
|
|
omarchy-system-reboot
|
|
fi
|
|
else
|
|
echo "Aborted. No changes made. Docker access still goes through a prompt."
|
|
fi
|