Any user process can escalate to root

The security vulnerability lies in the default user configuration of the Linux Docker group on Omarchy systems. This configuration allows users to run Docker commands without using sudo. The Docker daemon, which runs with root privileges, listens on a socket located at /var/run/docker.sock. Users who are part of the docker group can interact with this socket to execute commands with root-level permissions.

This means that the default user on affected Omarchy systems, as well as any processes initiated by that user, can access root privileges. Essentially, any user process can escalate to root. This discovery was made by an engineer who had been using the docker group for convenience, but was unaware of the significant security risks it posed.

The situation is particularly concerning as many systems are now running LLM coding harnesses with full shell access under user accounts. The recommended solution is to migrate away from this configuration and use Podman, which does not rely on a root-owned socket. This change could be beneficial for security and also aligns better with systemd + *.container unit file management.