Can someone explain how Omarchy is bloated or insecure?
I’ve used Omarchy pretty regularly since 4.0 came out in August, though I also dabbled with it last year when the first version was released, and overall I’ve had a pretty good experience with it.
At the same time, I still see a lot of criticism whenever Omarchy comes up, whether it is in other channels on Reddit or on Twitter. Some of it seems less about the distro itself and more about DHH and his political opinions, the heavy emphasis on AI/vibe coding, or concerns about the people and organizations funding the Omarchy Foundation.
I understand those arguments, even if I don’t necessarily agree with all of them.
What I’m more interested in are the technical criticisms, particularly people calling Omarchy bloated or insecure.
When people say Omarchy is bloated, what exactly do they mean?
It doesn’t seem to me like much software is installed by default, and it’s not exactly hard to remove what you don’t want. Personally, I usually end up removing maybe Docker, Lazydocker, Fastfetch, fcitx, and some of the web apps. I also recently found out that you can remove a lot of the web apps from the terminal in far fewer steps; unfortunately, you still have to do them one by one, but it is more convenient than using the menu.
Is the criticism simply about the amount or type of software installed by default? Is it more about not having much choice during installation, unlike something like CachyOS, which I’ve recently been experimenting with using Niri? Or is there something deeper going on?
I ask because whenever I install something like Fedora, I usually end up removing a bunch of software anyway. Depending on the installation, that might be Transmission, Pidgin, HexChat, various GNOME applications or games, and other packages I know I’m never going to use.
So having opinionated software choices in Omarchy doesn’t really strike me as fundamentally different. I just remove or replace what I don’t want.
The security criticism is the part I’m even more curious about.
I know legitimate concerns have been raised in the past. For example, there was the issue surrounding Kitty’s remote-control functionality, and Omarchy adds the user to the docker group.
My understanding of the Docker issue is that adding a user to the docker group lets you run Docker commands without sudo, but membership in that group effectively gives the user root-equivalent privileges because Docker can mount the host filesystem, start privileged containers, etc.
That’s obviously something worth understanding, but it’s also a fairly common Docker configuration rather than something completely unique to Omarchy.
So what, specifically, is Omarchy doing that makes the claim that it’s less secure than a normal Arch, Fedora, Ubuntu, etc. installation?
Are there currently insecure defaults, exposed services, questionable permissions, unnecessary daemons, bad firewall/network settings, supply-chain concerns, or something else?
I’m genuinely interested in the technical criticism here. I’d especially like to hear concrete examples rather than just "Omarchy is insecure" or "Omarchy is bloated," because I see those claims fairly often without much explanation of what specifically is wrong.
I’m also curious whether some of the technical criticism is legitimate but gets mixed together with people simply disliking DHH, the project’s direction, or the culture around it.