Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
Docker DB installer containers don't survive reboot (docker.service disabled, only docker.socket enabled)
Reported by jlupox · filed Aug 27, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
Omarchy 4.0.1-1 (Quattro), Docker 29.7.2, PostgreSQL installed via Install > Development > Docker DB, Reproduced on two separate Omarchy Quattro 4.0.1 systems
What's wrong?
Containers installed through Install > Development > Docker DB do not come back up after a reboot, even though they're configured with --restart unless-stopped.
After boot:
docker.service disabled / inactive
docker.socket enabled / listening
postgres18 stoppedA TCP connection to a published container port (e.g. a Rails app connecting to 127.0.0.1:5432) does not activate the daemon and fails with Connection refused. Running sudo docker ps -a does activate it (because it hits /run/docker.sock directly), and once the daemon is up, Postgres starts on its own thanks to unless-stopped — no other action needed.
Root cause
This is intentional in Quattro: only docker.socket is enabled at boot, docker.service is explicitly disabled:
- install/config/enable-services.sh:7 → enables docker.socket only
- bin/omarchy-upgrade-to-quattro:1350 → systemctl disable docker.service
- bin/omarchy-upgrade-to-quattro:1356 → enables docker.socket
Socket activation only wakes the daemon when something touches /run/docker.sock directly (e.g. docker ps). A TCP connection to a container's published port goes through docker-proxy, a child process of dockerd — which doesn't exist while the daemon is down, so there's no listener at all. --restart unless-stopped is a daemon-side policy applied when the daemon starts, so it never gets a chance to fire if the daemon never starts.
This affects every database installable through that menu, not just Postgres — they're all published on loopback ports with the same restart policy (bin/omarchy-install-docker-dbs:18-23).
Steps to reproduce
- Install PostgreSQL via
Install > Development > Docker DB > PostgreSQL - Verify the container is running
- Reboot
- Start a local app configured to use
127.0.0.1:5432 - Connection is refused
- Run
sudo docker ps -a - Access the app again — it now works
Expected behavior
A DB installed through Install > Development > Docker DB should be reachable after a reboot without manual intervention, or Quattro should document the expected mechanism to bring these containers up.
Suggested fix
Enable docker.service alongside docker.socket when installing anything from the Docker DB menu:
sudo systemctl enable --now docker.serviceThis shouldn't cost boot time — the repo already ships a drop-in that keeps docker.service off the boot critical path:
etc/systemd/system/docker.service.d/no-block-boot.conf
[Unit]
DefaultDependencies=noSo the socket stays as-is and just doesn't need to be "poked" anymore for containers with published ports to survive a reboot.
Happy to submit a PR with this fix if that's the direction you'd want — just let me know.
Related
Originally reported and diagnosed in Discussion #8415: https://github.com/basecamp/omarchy/discussions/8415
View raw text
### System details Omarchy 4.0.1-1 (Quattro), Docker 29.7.2, PostgreSQL installed via Install > Development > Docker DB, Reproduced on two separate Omarchy Quattro 4.0.1 systems ### What's wrong? Containers installed through `Install > Development > Docker DB` do not come back up after a reboot, even though they're configured with `--restart unless-stopped`. After boot: ``` docker.service disabled / inactive docker.socket enabled / listening postgres18 stopped ``` A TCP connection to a published container port (e.g. a Rails app connecting to `127.0.0.1:5432`) does not activate the daemon and fails with `Connection refused`. Running `sudo docker ps -a` does activate it (because it hits `/run/docker.sock` directly), and once the daemon is up, Postgres starts on its own thanks to `unless-stopped` — no other action needed. ### Root cause This is intentional in Quattro: only `docker.socket` is enabled at boot, `docker.service` is explicitly disabled: - `install/config/enable-services.sh:7` → enables `docker.socket` only - `bin/omarchy-upgrade-to-quattro:1350` → `systemctl disable docker.service` - `bin/omarchy-upgrade-to-quattro:1356` → enables `docker.socket` Socket activation only wakes the daemon when something touches `/run/docker.sock` directly (e.g. `docker ps`). A TCP connection to a container's published port goes through `docker-proxy`, a child process of `dockerd` — which doesn't exist while the daemon is down, so there's no listener at all. `--restart unless-stopped` is a daemon-side policy applied when the daemon starts, so it never gets a chance to fire if the daemon never starts. This affects every database installable through that menu, not just Postgres — they're all published on loopback ports with the same restart policy (`bin/omarchy-install-docker-dbs:18-23`). ### Steps to reproduce 1. Install PostgreSQL via `Install > Development > Docker DB > PostgreSQL` 2. Verify the container is running 3. Reboot 4. Start a local app configured to use `127.0.0.1:5432` 5. Connection is refused 6. Run `sudo docker ps -a` 7. Access the app again — it now works ### Expected behavior A DB installed through `Install > Development > Docker DB` should be reachable after a reboot without manual intervention, or Quattro should document the expected mechanism to bring these containers up. ### Suggested fix Enable `docker.service` alongside `docker.socket` when installing anything from the Docker DB menu: ``` sudo systemctl enable --now docker.service ``` This shouldn't cost boot time — the repo already ships a drop-in that keeps `docker.service` off the boot critical path: ``` etc/systemd/system/docker.service.d/no-block-boot.conf [Unit] DefaultDependencies=no ``` So the socket stays as-is and just doesn't need to be "poked" anymore for containers with published ports to survive a reboot. Happy to submit a PR with this fix if that's the direction you'd want — just let me know. ### Related Originally reported and diagnosed in Discussion #8415: https://github.com/basecamp/omarchy/discussions/8415
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Fixed bypr/11386· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 09:28 UTC