--- title: Omarchy's Docker bug hands out root, DHH calls the... description: Omarchy's meteoric funding run collided with a nasty security disclosure this week: every version before 4.0.1 silently added users to the Docker group,... canonical: https://daily.dev/posts/omarchy-s-docker-bug-hands-out-root-dhh-calls-the-growth-unprecedented-f7qwufqzb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Omarchy's Docker bug hands out root, DHH calls the growth unprecedented | daily.dev og:description: Omarchy's meteoric funding run collided with a nasty security disclosure this week: every version before 4.0.1 silently added users to the Docker group,... og:url: https://daily.dev/posts/omarchy-s-docker-bug-hands-out-root-dhh-calls-the-growth-unprecedented-f7qwufqzb og:image: https://api.daily.dev/og/posts/F7qwUfQzb.png og:image:alt: Omarchy's Docker bug hands out root, DHH calls the growth unprecedented og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Omarchy's Docker bug hands out root, DHH calls the growth unprecedented **[Open Source Digest](https://daily.dev/sources/opensource_digest)** · 4 min read · 4 upvotes · 0 comments ## Summary Omarchy's meteoric funding run collided with a nasty security disclosure this week: every version before 4.0.1 silently added users to the Docker group, handing any desktop process a path to root. The Linux kernel's 7.3 merge window closed as the second-busiest ever, with AMD's graphics driver alone now 16% of the entire codebase. Debian formally settled its AI policy fight by refusing to pick a side, while git.kernel.org's maintainer published hard numbers on just how much of its traffic is AI scrapers rather than humans. DuckDB's steward joined AWS, and rsync's maintainers are drowning in AI-generated vulnerability noise even as real CVEs still slip through. ## Content **TLDR:** Omarchy's meteoric funding run collided with a nasty security disclosure this week: every version before 4.0.1 silently added users to the Docker group, handing any desktop process a path to root. The Linux kernel's 7.3 merge window closed as the second-busiest ever, with AMD's graphics driver alone now 16% of the entire codebase. Debian formally settled its AI policy fight by refusing to pick a side, while git.kernel.org's maintainer published hard numbers on just how much of its traffic is AI scrapers rather than humans. DuckDB's steward joined AWS, and rsync's maintainers are drowning in AI-generated vulnerability noise even as real CVEs still slip through. --- ## Omarchy shipped root-by-default Docker for over a year before a fix landed Every Omarchy release before 4.0.1 silently added users to the Docker group, meaning any process in your desktop session, your browser, your editor, an unreviewed npm postinstall script, had a straight path to root with no sudo prompt required. A security researcher found /etc/shadow and everything else was readable this way; the bug shipped in June 2025 and sat there until August 24, 2026. The docs claimed Docker was running rootless. It wasn't. The recommended fix is to ditch Docker for Podman, and there's now a live proposal for DHH to adopt bootc for signed, immutable images, which suddenly looks a lot more urgent. [Read more](https://daily.dev/feed-by-ids?id=T9972AdJG&id=0eqZIgfcL) ## DHH says Omarchy is growing faster than Rails ever did Omarchy 4 (Quattro) shipped this week with a full QuickShell rewrite, a sub-6GB ISO, built-in AI agent selection, and voice dictation, and DHH is telling anyone who'll listen it's the fastest-growing thing he's ever touched, Rails included. A startup founder is already issuing new hires Dell XPS laptops with Omarchy instead of Macs. None of this changes the fact that the distro just had a root-escalation bug sit unpatched for over a year, and I can't quite square the growth-hype cycle with that timeline. [Read more](https://daily.dev/feed-by-ids?id=xY0MbLm0m&id=TULBAs8sf&id=e1NJ2ulmm&id=Nyjgoax2W&id=ZVabV3tGH&id=PjkxZ2V9o) ## Linux 7.3-rc1 lands as the second-busiest merge window ever, and AMD's driver is eating the kernel 15,267 commits landed in the 7.3 merge window, second only to 6.7. The kernel is now near 41 million lines, and the AMD graphics driver alone is 6.52 million of them, about 16% of the whole codebase, largely from new DCN6 register headers for upcoming hardware. Buried in the same window: Btrfs direct I/O approaching 95% throughput, EXT4 hitting 2.19M IOPS, a 71% cut in ZSTD decompression time from fixing a redundant CPUID re-probe, and a VRAM overcommit fix that stops decade-old AMD GPUs from deadlocking under memory pressure, something Windows never patched. [Read more](https://daily.dev/feed-by-ids?id=QXSoIttY9&id=Zshp9rW2O&id=dA0i4AGni&id=X5wuPj1Ld) ## Debian votes to neither ban nor endorse AI, rsync maintainers describe drowning anyway Debian's general resolution settled on 'Responsible Use of Generative AI', a deliberate non-answer that leaves contributors accountable for whatever they submit without requiring disclosure. Meanwhile the person embedded in rsync's 3.5.0 security audit describes triaging a few hundred candidate reports, filing 99 formally, and shipping 33 fixes including a HIGH-severity hosts-deny bypass, while arguing that LLM-generated vulnerability claims have made it nearly free to generate work for maintainers whose judgment and time remain entirely human and scarce. [Read more](https://daily.dev/feed-by-ids?id=8scuygWXp&id=1qX3x4JCV&id=ye8Z1I3IY) --- ## Also notable - **git.kernel.org: only 2% of traffic is human:** 14-16 of 90 CPU cores across the kernel's git hosting infrastructure are constantly busy rendering commits for AI scraper bots, with legitimate human traffic estimated at just 2% of total requests. [Read more](https://daily.dev/feed-by-ids?id=W1XrIJb39&id=LZV5vOiki) - **DuckLabs, the company behind DuckDB, is joining AWS:** The ~30-person Amsterdam team stays together and DuckDB remains MIT-licensed under the independent DuckDB Foundation, but AWS now controls the roadmap through the people who write the code. [Read more](https://daily.dev/feed-by-ids?id=Iw2wusLji&id=tq2Z4SE6N) - **8,300+ Gitea servers are still unpatched against a critical RCE:** CVE-2026-60004 lets even unauthenticated attackers register an account, create a repo, and execute arbitrary shell commands via Gitea's diffpatch endpoint; CISA added it to the KEV catalog and attackers are already deploying cryptominers on unpatched instances. [Read more](https://daily.dev/feed-by-ids?id=RbH2jcepp&id=gMz4NKJzi) - **California's AB-1856 exempts Linux distros from age-verification law:** The bill passed the Assembly 69-0 and carves out open-source operating systems from the state's Digital Age Assurance Act, which otherwise takes effect January 1, 2027. [Read more](https://daily.dev/feed-by-ids?id=B3tDIc507&id=MBw6DVYpM) - **Rust Foundation names its first five Maintainers in Residence:** Funded by a $350,000 pool from Google, AWS, and OpenAI, the cohort covers Rustup, Clippy, rustdoc, the compiler, and the standard library, with full-time positions costing about $120,000/year each. [Read more](https://daily.dev/posts/bTsclio9w) --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#linux](https://daily.dev/tags/linux), [#docker](https://daily.dev/tags/docker) [View this post on daily.dev](https://daily.dev/posts/omarchy-s-docker-bug-hands-out-root-dhh-calls-the-growth-unprecedented-f7qwufqzb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/omarchy-s-docker-bug-hands-out-root-dhh-calls-the-growth-unprecedented-f7qwufqzb","headline":"Omarchy's Docker bug hands out root, DHH calls the growth unprecedented","text":"Omarchy's meteoric funding run collided with a nasty security disclosure this week: every version before 4.0.1 silently added users to the Docker group, handing any desktop process a path to root. The Linux kernel's 7.3 merge window closed as the second-busiest ever, with AMD's graphics driver alone now 16% of the entire codebase. Debian formally settled its AI policy fight by refusing to pick a side, while git.kernel.org's maintainer published hard numbers on just how much of its traffic is AI scrapers rather than humans. DuckDB's steward joined AWS, and rsync's maintainers are drowning in AI-generated vulnerability noise even as real CVEs still slip through.","url":"https://daily.dev/posts/omarchy-s-docker-bug-hands-out-root-dhh-calls-the-growth-unprecedented-f7qwufqzb","datePublished":"2026-08-31T04:20:05.187Z","dateModified":"2026-08-31T04:20:27.004Z","author":{"@type":"Organization","name":"Open Source Digest","logo":"https://media.daily.dev/image/upload/s--9lMKiPTq--/f_auto,q_auto/v1773839407/logos/opensource_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/opensource_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/opensource_digest","name":"Open Source Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Open Source Digest","item":"https://daily.dev/sources/opensource_digest"},{"@type":"ListItem","position":3,"name":"Omarchy's Docker bug hands out root, DHH calls the growth unprecedented"}]} ```