Omarchy Default Docker Setup Lets Any User Process Escalate to Root
The default Omarchy account sat in the docker group, which is effectively root, and the documentation misled users into thinking Docker ran rootless, so the fix was a configuration change, not a code patch.
Reporting from 1 source: GIGAZINE.
A security vulnerability in Omarchy's default Docker configuration lets any user process escalate to root privileges without a password or sudo. The default user is a member of the docker group, which can command the root-level Docker daemon to mount the host filesystem and read files like /etc/shadow. The setting was opt-out, not opt-in. Version 4.0.1 removes the docker group from the default configuration.
The proof of concept is straightforward. On a fresh install, a normal user gets "Permission denied" reading /etc/shadow, then runs "docker run --rm -v /:/hostroot alpine cat /hostroot/etc/shadow" and the file appears. The docker group is the whole problem: Docker itself warns that group members get root-level privileges by default. Omarchy's developer documentation said the group change let users "run Docker as the normal user and not as root," which could mislead users into thinking Docker ran rootless. The fix, applied on August 24, 2026, removes the docker group from the default configuration. Users on versions before 4.0.1 should update.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.