Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4834GitHub issuePublicReceived

omarchy-windows-vm: launch fails when the dockur container re-adds setgid to ~/Windows

Reported by Rana-Droid-7 · filed Sep 2, 2026Closed upstream on 2026-09-20 by bjarneo via an automated message, as a duplicate of #9334 (R-1173). GitHub close reason: completed.

Open at source
Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

omarchy-windows-vm: launch fails when the dockur container re-adds setgid to ~/Windowsrevision 1 · captured 2026-10-04 12:03 UTC via poll

Description

omarchy-windows-vm launch starts the VM only on the FIRST run. After the VM
has run once (or been launched via up/up_wait), every subsequent launch
fails with ❌ Failed to start Windows VM! even though the VM is healthy when
started directly via pkexec or from the web console at http://127.0.0.1:8006.

Root cause

Running the dockur/windows container chmods the shared-folder bind source
~/Windows to mode 2777 (setgid + world-writable). The mode persists after
the container stops.

On the next start, Omarchy's prepare_caller_mounts runs
chmod 0700 ~/Windows, then requires the mount to match mode exactly 700
(mounted_leaf_matches tests [[ $mode == 700 ]]). But the kernel
preserves the setgid bit on a directory for root/in-group chmod, so the
mount ends up 2700 != 700 and start silently aborts.

chmod 0700 cannot clear S_ISGID on a directory; the script must strip
special modes explicitly, e.g. chmod u-s,g-s,o-s ~/Windows.

Workaround on the affected system: chmod u-s,g-s,o-s ~/Windows while the VM
is stopped, so mode returns to 0700 before the next launch.

Expected

  • prepare_caller_mounts / bind_mount_leaf explicitly clear S_ISGID/S_ISUID

(e.g. chmod u-s,g-s,o-s) in addition to chmod 0700, or
- the == "700" check tolerates/clears a leftover setgid bit.

Steps to reproduce

  1. omarchy-windows-vm install (configure a VM) then omarchy-windows-vm launch.
  2. Let the VM run and stop it (or shut it down from inside the guest).
  3. Run omarchy-windows-vm launch again.
  4. Observe: ❌ Failed to start Windows VM!.

Also confirm stat -c %a ~/Windows reads 2777 after step 2 and, while the VM
is stopped, chmod g-s ~/Windows makes launch succeed again.

System

  • Omarchy version: 4.0.2-1
  • Kernel: 7.1.9-arch1-2
  • CPU: AMD Ryzen 3 7320U (KVM /dev/kvm present)
  • Filesystem for storage: btrfs
View raw text
## Description

`omarchy-windows-vm launch` starts the VM only on the FIRST run. After the VM
has run once (or been launched via `up`/`up_wait`), every subsequent `launch`
fails with `❌ Failed to start Windows VM!` even though the VM is healthy when
started directly via pkexec or from the web console at `http://127.0.0.1:8006`.

## Root cause

Running the dockur/windows container chmods the shared-folder bind source
`~/Windows` to mode `2777` (setgid + world-writable). The mode persists after
the container stops.

On the next start, Omarchy's `prepare_caller_mounts` runs
`chmod 0700 ~/Windows`, then requires the mount to match mode exactly `700`
(`mounted_leaf_matches` tests `[[ $mode == 700 ]]`). But the kernel
**preserves the setgid bit on a directory for root/in-group chmod**, so the
mount ends up `2700 != 700` and start silently aborts.

`chmod 0700` cannot clear `S_ISGID` on a directory; the script must strip
special modes explicitly, e.g. `chmod u-s,g-s,o-s ~/Windows`.

Workaround on the affected system: `chmod u-s,g-s,o-s ~/Windows` while the VM
is stopped, so mode returns to `0700` before the next launch.

## Expected

- `prepare_caller_mounts` / `bind_mount_leaf` explicitly clear `S_ISGID`/`S_ISUID`
  (e.g. `chmod u-s,g-s,o-s`) in addition to `chmod 0700`, or
- the `== "700"` check tolerates/clears a leftover setgid bit.

## Steps to reproduce

1. `omarchy-windows-vm install` (configure a VM) then `omarchy-windows-vm launch`.
2. Let the VM run and stop it (or shut it down from inside the guest).
3. Run `omarchy-windows-vm launch` again.
4. Observe: `❌ Failed to start Windows VM!`.

Also confirm `stat -c %a ~/Windows` reads `2777` after step 2 and, while the VM
is stopped, `chmod g-s ~/Windows` makes `launch` succeed again.

## System

- Omarchy version: `4.0.2-1`
- Kernel: `7.1.9-arch1-2`
- CPU: AMD Ryzen 3 7320U (KVM `/dev/kvm` present)
- Filesystem for storage: btrfs

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.