Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4318GitHub issuePublicReceived

Docker DNS firewall rule does not cover Docker default 192.168 address pool

Reported by davzucky · filed Apr 27, 2026Closed upstream on 2026-04-29 by the merge of PR #5465 (closed by dhh). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Docker DNS firewall rule does not cover Docker default 192.168 address poolrevision 1 · captured 2026-10-04 11:56 UTC via poll

System details

Omarchy 2.x, Docker Engine with Omarchy-managed /etc/docker/daemon.json containing \"dns\": [\"172.17.0.1\"], UFW enabled.

What's wrong?

Omarchy configures Docker DNS to use 172.17.0.1, and adds a UFW allow rule for Docker DNS from 172.16.0.0/12:

172.17.0.1 53/udp ALLOW IN 172.16.0.0/12 # allow-docker-dns

This works for Docker networks allocated from 172.16.0.0/12, for example 172.18.0.0/16. However, Docker's documented default local address pools also include 192.168.0.0/16 split into /20 networks:

https://docs.docker.com/engine/network/#subnet-allocation

Relevant documented default pool:

{ "base": "192.168.0.0/16", "size": 20 }

When enough 172.x Docker networks already exist, Docker can allocate a user-defined bridge network such as:

192.168.0.0/20

Containers on that network still use Docker embedded DNS 127.0.0.11, which forwards external DNS lookups to the daemon-configured DNS server 172.17.0.1:

https://docs.docker.com/engine/network/#dns-services

But the current UFW rule does not allow 192.168.0.0/16 -> 172.17.0.1:53, so DNS resolution fails inside those containers/devcontainers, while other containers on 172.x networks continue to work.

Observed failure example:

curl: (6) Could not resolve host: registry.npmjs.org

Observed workaround:

sudo ufw allow in from 192.168.0.0/16 to 172.17.0.1 port 53 proto udp comment allow-docker-dns-192

After adding that rule, DNS resolution in the affected Docker/devcontainer network works.

Suggested fix

Extend Omarchy's Docker DNS UFW rule to cover Docker's documented 192.168.0.0/16 default address pool as well as 172.16.0.0/12, for example:

ufw allow in from 192.168.0.0/16 to 172.17.0.1 port 53 proto udp comment allow-docker-dns

Optionally also include TCP/53 if Omarchy wants to support DNS TCP fallback, though UDP/53 matches the current rule and fixes the observed issue.

View raw text
### System details

Omarchy 2.x, Docker Engine with Omarchy-managed `/etc/docker/daemon.json` containing `\"dns\": [\"172.17.0.1\"]`, UFW enabled.

### What's wrong?

Omarchy configures Docker DNS to use `172.17.0.1`, and adds a UFW allow rule for Docker DNS from `172.16.0.0/12`:

```text
172.17.0.1 53/udp ALLOW IN 172.16.0.0/12 # allow-docker-dns
```

This works for Docker networks allocated from `172.16.0.0/12`, for example `172.18.0.0/16`. However, Docker's documented default local address pools also include `192.168.0.0/16` split into `/20` networks:

https://docs.docker.com/engine/network/#subnet-allocation

Relevant documented default pool:

```json
{ "base": "192.168.0.0/16", "size": 20 }
```

When enough `172.x` Docker networks already exist, Docker can allocate a user-defined bridge network such as:

```text
192.168.0.0/20
```

Containers on that network still use Docker embedded DNS `127.0.0.11`, which forwards external DNS lookups to the daemon-configured DNS server `172.17.0.1`:

https://docs.docker.com/engine/network/#dns-services

But the current UFW rule does not allow `192.168.0.0/16 -> 172.17.0.1:53`, so DNS resolution fails inside those containers/devcontainers, while other containers on `172.x` networks continue to work.

Observed failure example:

```text
curl: (6) Could not resolve host: registry.npmjs.org
```

Observed workaround:

```bash
sudo ufw allow in from 192.168.0.0/16 to 172.17.0.1 port 53 proto udp comment allow-docker-dns-192
```

After adding that rule, DNS resolution in the affected Docker/devcontainer network works.

### Suggested fix

Extend Omarchy's Docker DNS UFW rule to cover Docker's documented `192.168.0.0/16` default address pool as well as `172.16.0.0/12`, for example:

```bash
ufw allow in from 192.168.0.0/16 to 172.17.0.1 port 53 proto udp comment allow-docker-dns
```

Optionally also include TCP/53 if Omarchy wants to support DNS TCP fallback, though UDP/53 matches the current rule and fixes the observed issue.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.