upvote

points

by exitb13 hours ago |
comments
upvoteby pibaker13 hours ago|
next
[-]
It is one thing to do things the risky way on your own system and another thing to ship an unsafe and unconventional default to your users.
reply
upvoteby LinXitoW11 hours ago|
parent|
[-]
For a single user, opinionated, modern, developer focussed OS, this is completely and utterly on par. Using docker as a developer without this is just plain annoying.
reply
upvoteby tasuki10 hours ago|
parent|
[-]
Just use podman, as the article suggests.
reply
upvoteby mort969 hours ago|
parent|
[-]
Too much stuff doesn't work with Podman still.

Especially if you're on an SELinux system.

reply
upvoteby lrvick12 hours ago|
prev|
next
[-]
Docker can be run rootless. It is so easy. No excuse for desktop distros to not do this by default. And that is why all major Linux distros are just as bad as Omarchy (Not recommending MacOS or Windows either as those are wildly worse)
reply
upvoteby steve197712 hours ago|
prev|
next
[-]
Using Docker instead of podman is the first mistake and that is a distro decision (or a "chef" decision, in Omarchy parlance...)
reply
upvoteby hemlock459310 hours ago|
parent|
[-]
*rootfull docker.

Rootless docker is perfectly fine.

reply
upvoteby gruez13 hours ago|
prev|
next
[-]
>when it’s a very common setup to add regular user to the docker group.

As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.

reply
upvoteby bardsore13 hours ago|
parent|
next
[-]
Adding your user to the docker group is in the official Docker install instructions, I wouldn't call that "random copy paste guides".
reply
upvoteby gruez12 hours ago|
parent|
[-]
You mean the optional post install instructions, which is a separate page from the main install instructions, and contains a giant warning about the security implications?

https://docs.docker.com/engine/install/linux-postinstall

If the official sudo project had a guide on how to disable passwords, that shouldn't be taken as endorsement of having that as a default config.

reply
upvoteby lrvick12 hours ago|
parent|
[-]
Per my other comments, it does not really matter if you disable the sudo password or not. If you have a sudo binary at all you effectively are giving every user process root since malware can mask the sudo command and intercept the password so trivially.
reply
upvoteby dpkirchner13 hours ago|
parent|
prev|
next
[-]
The methods are described on the official docker website, not just random blogs or SO pages. There are caveats about security, of course, but it's not truly discouraged.
reply
upvoteby skydhash12 hours ago|
parent|
[-]
I think there are notes that warn you about the consequences. And they have been written with sys admin in mind which knows about user groups and security.
reply
upvoteby ezst12 hours ago|
parent|
prev|
[-]
You mean, just how it is on Windows?
reply
upvoteby 12 hours ago|
parent|
[-]
deleted
reply
upvoteby dawnerd9 hours ago|
prev|
next
[-]
Docker itself is such a massive security problem. Like it’ll punch through your firewall. Found out the hard way after a misconfigured redis was exposed to the web.
reply
upvoteby Aurornis12 hours ago|
prev|
next
[-]
> but I’m not sure this should be framed as Omarchy-specific,

Adding the user to the docker group by default, out of the box, is Omarchy-specific.

EDIT: More accurately, was Omarchy specific, until they realized that it's not a good idea and changed it.

reply
upvoteby StrLght11 hours ago|
prev|
next
[-]
Exactly! I was also surprised by this — that's a sensible default for many people.

However, I agree that it should be opt-in. Docs should be more explicit about that too, they should warn users about risks of going with that option. That excerpt mentioned in the article was rather misleading.

reply
upvoteby pixl9712 hours ago|
prev|
next
[-]
This also seems like one of the more common things LLMs use to priv escalate themselves when not given root access, seems like a rather common misconfiguration.
reply
upvoteby bakugo10 hours ago|
prev|
[-]
It's absolutely not Omarchy-specific, Ubuntu has the exact same vulnerability out of the box, just with lxd instead.
reply