DHH's Omarchy left every desktop process one command away from root for 14 months

Omarchy carried a default that handed root to any process in the user’s desktop session. The Arch-based distro built by David Heinemeier Hansson put its install user in the docker group, and on Linux that group is passwordless root. The patch landed in version 4.0.1 on August 25.

The defect, in one command

Docker’s daemon on Arch runs as root and listens on a root-owned socket at /var/run/docker.sock. Anybody in the docker group can talk to that socket without sudo, which means they can ask a root-owned process to start a container, bind-mount the host filesystem into it, then read or rewrite anything on disk as root. Docker’s own post-install docs say it plainly: “The docker group grants root-level privileges to the user.” The researcher who publishes as 0xCC proved it in one line on a stock Omarchy box: docker run --rm -v /:/hostroot alpine cat /hostroot/etc/shadow. No password. No prompt. The shadow file came straight back. A compromised browser tab or a poisoned npm dependency was therefore one command from owning the whole machine.

Four details made this worse than the usual docker-group footgun:

• Everything inherited it. Linux passes supplementary groups down to child processes, so 0xCC found the group on essentially every process under the user’s systemd --user tree, from browsers and editors to npm scripts and coding agents.
• It was opt-out. Someone who never touched a container still got the group, because the tradeoff was made for them at install time.
• The manual pointed the wrong way. Omarchy’s development-tools page advertised “the user group changes needed for you to run Docker as the normal user and not as root”, which reads like rootless Docker. It wasn’t rootless.
• It reached back into 3.x. 0xCC tested the 3.8.4 ISO and found it affected, so this wasn’t a Quattro regression.

Two hours from open to merge

Heinemeier Hansson added the group on June 1, 2025, in a commit titled “Do all the additional Docker configuration needed”. He pulled it a day later because it broke logout on Arch, then restored it on June 17. It stayed for the next 14 months.

The removal was quick. Pull request #8056 opened at 14:57 UTC on August 24 and merged at 16:56 UTC, touching 18 files. Its description doesn’t soften anything: “The docker group is root-equivalent: anything in it can docker run -v /:/host and rewrite the host as root with no password.” The daemon still runs. The Docker TUI and the Windows VM now reach it through a polkit prompt, plain docker runs under sudo, and sudoless Docker survives as a warned opt-in. Existing machines drop the group at next login. The merge credits Claude Opus 4.8 and Codex XHigh as co-authors, which puts it in the same bucket as the AI-written patches Rust and the Linux kernel just wrote rules about.

Version 4.0.1 shipped the next morning with 11 security fixes. “Omarchy v4.0.1 has been release with some security patches and other fixes”, Heinemeier Hansson wrote on X, thanking “our new awesome Omarchy Security team”. Three hours later he credited “@teles_dev for the first report on a Docker permissions issue”. 0xCC published the writeup on August 28, once the patch was out.

What’s still open

Nobody has published a count of affected machines, and no CVE was assigned. Omarchy’s security credits page names six reporters without saying who found what, so the public record has Heinemeier Hansson thanking Teles while 0xCC says they filed through the same disclosure process. Whether anyone used the gap in those 14 months is unknown, and on a single-user laptop it may never be provable.

Speed is the thread running through all of this. Omarchy went from an empty repository in June 2025 to more than 36,000 GitHub stars and a foundation that The Register reports launched with $8 million and now holds $10 million. The security team that validated 4.0.1 is brand new. Version 4.0.2, out on August 31, carried another 11 security fixes. 0xCC is generous about the response and cold about the process: “I was amazed by the speed of response to this issue being reported which is a healthy sign.” His next sentence: “That said, this isn’t the first time I have ran into security issues with Omarchy and frankly I do not trust the decision making process as it stands.”

What this means for you

Run id. If docker appears in your group list, that machine still has the passwordless route to root open. Update through Update > Omarchy to reach 4.0.1 or later and the migration strips the group at your next login. If you’d rather not wait, 0xCC’s instruction works on any distro: gpasswd --delete <username> docker. Expect some friction afterward, because the docker CLI now wants sudo, and the TUI and Windows VM ask for authorization through polkit. While you’re in there, the expiring Secure Boot certificates are the other Linux chore worth ten minutes.

I checked the repository on September 1: install/config/docker.sh no longer grants the group at tag v4.0.1 or on main, and it has held through 4.0.2. The fix is also narrow. The daemon still runs as root, so anyone who re-enables sudoless Docker is back where they started. That’s what the r/omarchy thread after the fix keeps pointing at: rootless Docker or Podman should be the default. Omarchy hasn’t gone there yet.