Omarchy’s Default Docker Group Let Any User Process Become Root

Omarchy, David Heinemeier Hansson’s opinionated Arch Linux setup for developers, shipped for more than a year with a default that let essentially any program in the user’s desktop session become root without a password, sudo or a prompt. A researcher who reported the issue privately published the details on Friday after the fix landed. Versions before 4.0.1 are affected, so Omarchy users should update.

The docker group is root

Omarchy added its default user to the Linux docker group. On Arch, the Docker daemon runs as root and listens on a Unix socket that docker group members can talk to, and Docker’s own documentation warns that the group grants root-level privileges. Any process with access to the socket can ask the daemon to start a container as root, mount the host filesystem into it, and read or change anything.

The write-up demonstrates it on a fresh install of 3.8.4: the ordinary user can’t read the system’s protected password-hash file directly, but a single docker run command that mounts the host’s root directory into a small Alpine container prints the whole file, because the actual read is done by the root-owned daemon.

Because supplementary groups are inherited by child processes, the researcher found the docker group on essentially every normal process under the user’s systemd –user instance. That means a compromised browser tab, a malicious package script, a bad editor plugin or an AI coding agent running as the user could all escalate to root.

The setting was opt-out rather than opt-in, and users didn’t have to use Docker to get it. Omarchy’s documentation said the group change let users “run Docker as the normal user and not as root,” which the researcher notes many readers would take to mean a rootless setup, close to the opposite of what was happening.

Timeline and fix

According to the commit history in the post, docker group membership was introduced on June 1, 2025, briefly disabled the next day, re-enabled on June 17, 2025, and removed from the default configuration on Aug. 24 of this year. The researcher credited the project’s speed once the report came in and called the default “just an oversight,” though they added that this wasn’t the first Omarchy security issue they had run into.

Existing users on older releases should update to 4.0.1 or later and check whether their account is still in the docker group. For people who want containers without a root daemon at all, the researcher recommends Podman, which runs containers as normal child processes in user namespaces.