You installed Docker because everyone said it was the modern way to build software. You were promised secure isolation, clean environments, and zero conflicts. It was supposed to be a sandbox.
It’s actually a backdoor.
Convenience is just a backdoor wearing a nice suit.
We just saw this play out with Omarchy. A security researcher pointed out that any unprivileged user process can escalate to root on the host. The internet’s response? A collective shrug mixed with dark laughter. One commenter noted that this misconfiguration is so trivial that LLMs have been known to exploit it unprompted, just trying to finish a task.
Think about the absurdity of that. An AI agent, trying to compile a script or run a basic test, accidentally stumbles into taking over your entire server. We spend billions on zero-day research, patching kernels, and hunting advanced persistent threats. Meanwhile, we hand the container daemon the keys to the kingdom and leave the front door wide open.
When your AI agent can accidentally hijack the entire host just to finish a task, the problem isn’t the AI. It’s your architecture.
The real vulnerability here isn’t a missing permission check or a clever exploit path. It’s the architectural assumption that a container daemon can safely reside within a user process’s reach. The chain of user process -> Docker -> root is not an exploit. It is the logical output of granting users root by proxy. You didn’t get hacked; you just installed a fundamentally broken trust boundary.
Containers are sold as secure isolation, yet the daemon used to manage them is semantically equivalent to root. The same ease that makes Docker convenient is exactly what makes any random process able to seize the host. If you run Omarchy, Docker, or any container-as-service setup, you need to check who can reach the container socket right now.
If an unprivileged user can talk to your container socket, your host is rootable by design.
Stop pretending Docker is a safe default. It is 2026. Rootless Podman has been around for years and works flawlessly. If you absolutely must run Docker, isolate it in a VM like you’re forced to do on macOS. Don’t let the illusion of isolation be your undoing.
Security isn’t a feature you add; it’s a boundary you refuse to cross. If your container setup doesn’t respect that boundary, it’s not a tool. It’s a liability.
FAQ
Q: Isn't this just an edge case or a misconfiguration specific to Omarchy?
A: No, it's an architectural flaw in how Docker is deployed by default. If the daemon runs as root and a user process can reach the socket, you've granted root by proxy. Omarchy just exposed how common this blind spot is.
Q: What's the practical implication for my setup?
A: If you're running Docker on a host where unprivileged users or processes exist, check your container socket access immediately. If they can talk to it, your host is entirely rootable. You need rootless Podman or a dedicated VM.
Q: Why are we still using Docker if it's this insecure by default?
A: Inertia and convenience. We've built massive toolchains around it. But it's 2026—rootless Podman works perfectly. Continuing to install Docker by default on multi-user systems is completely insane.