1565919c87
Group membership is fixed at login, so removing (or adding) the docker group does not take effect in the running session. The existing-user migration and the Setup > Security toggles now call `omarchy-state set reboot-required`, so omarchy-update-restart prompts for the reboot that actually applies the change (and the bar shows it pending). A plain log out and back in still works. The migration test now exercises the real removal command and omarchy-state rather than a stub, asserting the reboot flag is set on removal and left alone when the user is already out of the group. Claude-Session: https://claude.ai/code/session_01Gb7x6poap4hGCndPx5qt5T Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.7 KiB
Bash
Executable File
42 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Enable sudoless Docker by adding your user to the docker group (root-equivalent!)
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
if id -nG "$USER" 2>/dev/null | grep -qw docker; then
|
|
echo "Sudoless Docker is already enabled: $USER is in the docker group."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
exit 0
|
|
fi
|
|
|
|
echo ""
|
|
echo "⚠️ WARNING: Enabling sudoless Docker adds you to the 'docker' group."
|
|
echo ""
|
|
echo "The Docker daemon runs as root, so membership in the docker group is"
|
|
echo "equivalent to passwordless root. Any process running as your user could"
|
|
echo "then run, for example:"
|
|
echo ""
|
|
echo " docker run -v /:/host alpine # full read/write of the host, as root"
|
|
echo ""
|
|
echo "and take over the machine with no password prompt. A single rogue script,"
|
|
echo "dependency, or plugin running as you is enough. It is convenient for"
|
|
echo "development, but it removes the protection Omarchy keeps by default, where"
|
|
echo "Docker access goes through a polkit/sudo prompt."
|
|
echo ""
|
|
|
|
if gum confirm "Enable sudoless Docker? This gives anything running as you passwordless root."; then
|
|
sudo usermod -aG docker "$USER"
|
|
# Group membership is fixed at login, so docker won't be reachable without a
|
|
# prompt until the session restarts. Flag a reboot so omarchy-update-restart
|
|
# prompts for one (and the bar shows it pending).
|
|
omarchy-state set reboot-required
|
|
echo ""
|
|
echo "Sudoless Docker ENABLED. Reboot, or log out and back in (or run 'newgrp docker'),"
|
|
echo "for the new group membership to take effect."
|
|
echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
|
|
else
|
|
echo "Aborted. No changes made. Docker access still goes through a prompt."
|
|
fi
|