Omarchy before 4.0.1 gave docker group members root access

On Omarchy installs before 4.0.1, the default user was added to the docker group, creating a passwordless path to root via the Docker socket. The membership was enabled on June 1, 2025, and finally removed from the default config on August 24, 2026; the fix shipped in 4.0.1.

• Docker group membership let users mount / and read /etc/shadow as root
• Every session process inherited it: browsers, IDEs, AI agents, npm scripts
• Enabled June 1, 2025, briefly disabled, removed from defaults on August 24, 2026
• All versions before 4.0.1 are affected, including the tested 3.8.4 ISO