Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1380GitHub issuePublicFixed

Docker DB installer containers don't survive reboot (docker.service disabled, only docker.socket enabled)

Reported by jlupox · filed Aug 27, 2026 · open at source

Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Docker DB installer containers don't survive reboot (docker.service disabled, only docker.socket enabled)revision 1 · captured 2026-09-28 21:24 UTC via poll

System details

Omarchy 4.0.1-1 (Quattro), Docker 29.7.2, PostgreSQL installed via Install > Development > Docker DB, Reproduced on two separate Omarchy Quattro 4.0.1 systems

What's wrong?

Containers installed through Install > Development > Docker DB do not come back up after a reboot, even though they're configured with --restart unless-stopped.

After boot:

docker.service disabled / inactive
docker.socket enabled / listening
postgres18 stopped

A TCP connection to a published container port (e.g. a Rails app connecting to 127.0.0.1:5432) does not activate the daemon and fails with Connection refused. Running sudo docker ps -a does activate it (because it hits /run/docker.sock directly), and once the daemon is up, Postgres starts on its own thanks to unless-stopped — no other action needed.

Root cause

This is intentional in Quattro: only docker.socket is enabled at boot, docker.service is explicitly disabled:
- install/config/enable-services.sh:7 → enables docker.socket only
- bin/omarchy-upgrade-to-quattro:1350 → systemctl disable docker.service
- bin/omarchy-upgrade-to-quattro:1356 → enables docker.socket

Socket activation only wakes the daemon when something touches /run/docker.sock directly (e.g. docker ps). A TCP connection to a container's published port goes through docker-proxy, a child process of dockerd — which doesn't exist while the daemon is down, so there's no listener at all. --restart unless-stopped is a daemon-side policy applied when the daemon starts, so it never gets a chance to fire if the daemon never starts.

This affects every database installable through that menu, not just Postgres — they're all published on loopback ports with the same restart policy (bin/omarchy-install-docker-dbs:18-23).

Steps to reproduce

  1. Install PostgreSQL via Install > Development > Docker DB > PostgreSQL
  2. Verify the container is running
  3. Reboot
  4. Start a local app configured to use 127.0.0.1:5432
  5. Connection is refused
  6. Run sudo docker ps -a
  7. Access the app again — it now works

Expected behavior

A DB installed through Install > Development > Docker DB should be reachable after a reboot without manual intervention, or Quattro should document the expected mechanism to bring these containers up.

Suggested fix

Enable docker.service alongside docker.socket when installing anything from the Docker DB menu:

sudo systemctl enable --now docker.service

This shouldn't cost boot time — the repo already ships a drop-in that keeps docker.service off the boot critical path:

etc/systemd/system/docker.service.d/no-block-boot.conf
[Unit]
DefaultDependencies=no

So the socket stays as-is and just doesn't need to be "poked" anymore for containers with published ports to survive a reboot.

Happy to submit a PR with this fix if that's the direction you'd want — just let me know.

Related

Originally reported and diagnosed in Discussion #8415: https://github.com/basecamp/omarchy/discussions/8415

View raw text
### System details

Omarchy 4.0.1-1 (Quattro), Docker 29.7.2, PostgreSQL installed via Install > Development > Docker DB, Reproduced on two separate Omarchy Quattro 4.0.1 systems 

### What's wrong?

Containers installed through `Install > Development > Docker DB` do not come back up after a reboot, even though they're configured with `--restart unless-stopped`.

After boot:

```
docker.service disabled / inactive
docker.socket enabled / listening
postgres18 stopped
```

A TCP connection to a published container port (e.g. a Rails app connecting to `127.0.0.1:5432`) does not activate the daemon and fails with `Connection refused`. Running `sudo docker ps -a` does activate it (because it hits `/run/docker.sock` directly), and once the daemon is up, Postgres starts on its own thanks to `unless-stopped` — no other action needed.

### Root cause
This is intentional in Quattro: only `docker.socket` is enabled at boot, `docker.service` is explicitly disabled:
- `install/config/enable-services.sh:7` → enables `docker.socket` only
- `bin/omarchy-upgrade-to-quattro:1350` → `systemctl disable docker.service`
- `bin/omarchy-upgrade-to-quattro:1356` → enables `docker.socket`

Socket activation only wakes the daemon when something touches `/run/docker.sock` directly (e.g. `docker ps`). A TCP connection to a container's published port goes through `docker-proxy`, a child process of `dockerd` — which doesn't exist while the daemon is down, so there's no listener at all. `--restart unless-stopped` is a daemon-side policy applied when the daemon starts, so it never gets a chance to fire if the daemon never starts.

This affects every database installable through that menu, not just Postgres — they're all published on loopback ports with the same restart policy (`bin/omarchy-install-docker-dbs:18-23`).

### Steps to reproduce
1. Install PostgreSQL via `Install > Development > Docker DB > PostgreSQL`
2. Verify the container is running
3. Reboot
4. Start a local app configured to use `127.0.0.1:5432`
5. Connection is refused
6. Run `sudo docker ps -a`
7. Access the app again — it now works

### Expected behavior
A DB installed through `Install > Development > Docker DB` should be reachable after a reboot without manual intervention, or Quattro should document the expected mechanism to bring these containers up.

### Suggested fix
Enable `docker.service` alongside `docker.socket` when installing anything from the Docker DB menu:

```
sudo systemctl enable --now docker.service
```

This shouldn't cost boot time — the repo already ships a drop-in that keeps `docker.service` off the boot critical path:

```
etc/systemd/system/docker.service.d/no-block-boot.conf
[Unit]
DefaultDependencies=no
```

So the socket stays as-is and just doesn't need to be "poked" anymore for containers with published ports to survive a reboot.

Happy to submit a PR with this fix if that's the direction you'd want — just let me know.

### Related
Originally reported and diagnosed in Discussion #8415: https://github.com/basecamp/omarchy/discussions/8415

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Fixed bypr/11386· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 09:28 UTC