If you use Omarchy, the most important takeaway is simple: update to 4.0.1.
Or just delete that racist shitware.
this post was submitted on 30 Aug 2026
74 points (98.7% liked)
Linux
14972 readers
343 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
Once more for the people in the back:
CONTAINERS ARE NOT A SECURITY BARRIER
If you are relying on the container system to isolate and protect the OS from containerized apps, you are wrong.
FWIW this isn't a container escape. It's just the distro shipping a shitty default that lets the users on the host access root.
On affected Omarchy systems, this means that the default user and all processes launched in that user session have access to root.
Hmm, maybe I'm misunderstanding. Does "all processes launched in that user session" not include containerized apps?
The issue isn't that the containers have permissions they weren't assigned. It's that the system configuration allows any (host) user to make a container with any permissions, without sudo.
The issue is that the docker service runs as root and their defaults added the user to a group that allows them to control that service without sudo
So, the root filesystem can just be passed as a volume to a container and then do whatever you want from there.
OK, so if you can pass the host root filesystem to a container and then write files or execute code with root privileges on that filesystem, I would definitely consider that a container escape. You're executing arbitrary code on the host from within a container.
I ain't got enuff hardware for qubesos
Go go gadget rootless podman UID mapping and cgroups black magic!
What? The "AI first" OS is buggy and insecure? Who could have guessed?
Omarchy: I'm a fascist, btw.
Omarchy is a distro for chuds.
Literally who linux