Field Notes · Linux
Omarchy, Before We Commit
A new machine is going in as a dedicated AI workstation, and Omarchy is first in line to run on it. Before any USB stick gets written, here is the honest state of what it supports and what it does not, checked against the project's own manual, its GitHub issue tracker, and independent security write-ups rather than the marketing page alone.
What it actually is
Omarchy is not its own distro with its own package format. It is a configuration layer and installer on top of vanilla Arch Linux (rolling release), running the Hyprland tiling Wayland compositor. As of version 4.0 ("Quattro"), the desktop shell moved to Quickshell, a QML-based replacement for the earlier Waybar and rofi stack. Packages still come from pacman and the AUR, same as any Arch box; Omarchy wraps that in a fuzzy-filter install menu rather than inventing a new tool. Default apps lean terminal-first: Neovim, Alacritty, Chromium, LibreOffice, Obsidian, and as of 3.7 a pre-wired gaming stack (Steam, Lutris, Heroic, RetroArch). Maintained by David Heinemeier Hansson as benevolent dictator, with a small core team and community sub-teams, not a foundation or a vote.
Hardware, the honest version
| Area | State | What that means |
|---|---|---|
| AMD / Intel GPU | Works | The smooth path for Hyprland. No Omarchy-specific issues surfaced; this matches the broader Linux/Wayland consensus that these two vendors are currently the least friction. |
| NVIDIA, single GPU | Partial | The installer auto-detects NVIDIA and installs the open kernel module (Turing or newer) or the legacy 580-series proprietary driver (Maxwell through Volta), writing the modesetting config for you. But Hyprland's own docs call NVIDIA "unsupported, but may work" — an upstream limitation, not something Omarchy fixes. Hyprlock/DPMS crashes on wake have been reported. |
| Hybrid graphics (Optimus) | Rough | The single roughest documented edge. Open GitHub issues as of late 2026: external monitors wired to the dGPU corrupting after deep suspend, screen recording silently failing on a dGPU-driven display, hardware video decode rendering transparent, and a config bug that force-sets the NVIDIA video decoder system-wide even on laptops where the dGPU drives no screen at all. A dual discrete GPU desktop setup (AMD plus NVIDIA, no laptop muxing) is documented and works; laptop Optimus switching is where it breaks. |
| Battery / power management | Partial | power-profiles-daemon ships by default and works, but community consensus is
that TLP gets materially better battery life and the migration is manual. One bug
report has a saved profile silently reverting to "ac" on reboot. |
| Fingerprint readers | Weak spot | A genuinely recurring, still-open bug class: fprintd does not reliably survive USB re-enumeration across suspend, so a reader that works at boot can stop answering verify calls after the first sleep cycle until the service is restarted by hand. Fair summary: "works until you suspend once," on a non-trivial subset of readers. |
| Printers / scanners | Works | A real strength. CUPS, cups-browsed, and Avahi are on by default, so driverless network printers show up on their own; SANE plus sane-airscan covers scanning the same way. The stock GUI dialog is plain, which is what community add-ons exist to dress up — the underlying path works out of the box. |
| External displays / HiDPI | Works | Auto-detects each output at its preferred mode, the Quickshell bar spans every monitor, and HiDPI scaling presets go up to 5K at 2x. This strength disappears specifically in the hybrid-GPU case above. |
| WiFi chipsets | Partial | Mostly fine, but the classic Linux chipset gotchas persist: some older Broadcom chips need a proprietary driver package that is not installed by default, and at least one Realtek USB chipset has an open report of scanning fine but failing to associate. These are upstream kernel driver gaps Omarchy inherits, not something it papers over. |
Software, the honest version
| Area | State | What that means |
|---|---|---|
| Native Linux dev stack | Works | Full modern browser, terminal-driven editors (Neovim default; VSCode, Zed, Ghostty swap in freely), per-project runtime versions via Mise, Docker. The workflow is deliberately keyboard-first and tiling — a design choice, not a bug, but mouse-and-dialog-heavy habits do not map over directly. |
| Steam / Proton gaming | Partial | Pre-wired install path, plus Lutris, Heroic, RetroArch and controller support as of 3.7. Kernel-level anti-cheat (EAC/BattlEye's strictest mode) is the real ceiling: roughly 55–66% of protected titles work, and that number is set entirely by whether the publisher opted into Linux support, not by Omarchy or any distro. Titles like Fortnite and Valorant are blocked outright and will stay that way regardless of distro. |
| Adobe Creative Suite | No native path | No Linux build, none planned. Runs poorly to not-at-all under Wine/Bottles. Real substitutes exist and are genuinely capable — GIMP and Krita for raster work, Inkscape for vector, Scribus for layout, and DaVinci Resolve (native Linux build, with its own Omarchy-specific install guide) for video — but they are substitutes, not drop-in replacements for an existing Adobe workflow. |
| Microsoft Office | Partial | No native build. The Office 365 web apps work fine in Chromium. Desktop Office via plain Wine is unreliable; CrossOver (commercial) is the most-cited path that actually works. LibreOffice ships by default and handles most documents well, with occasional fidelity loss on complex macros or formatting. |
| AutoCAD and similar CAD | No path | No native Linux version and no reliable Wine path. This is a hard blocker for anyone whose work depends on it, same as on any non-Windows system. |
| Enterprise fit | Not built in | No Active Directory join, no MDM, no Group Policy equivalent, no documented enterprise VPN or SSO tooling shipped or tested by the project. Vanilla Arch tooling (realmd/sssd, openconnect) can do pieces of this, but it is bespoke sysadmin work, not something Omarchy wires up. This is built for an individual workstation, not a managed fleet. |
Encryption, against BitLocker
Full-disk LUKS encryption is on by default in the standard installer, for both the full-disk and the free-space dual-boot paths, and it can be switched off deliberately for throwaway or remote installs. As encryption at rest, LUKS and BitLocker are the same category of protection, and LUKS is arguably more auditable since the spec and the implementation are both open. Where Omarchy has no equivalent is the surrounding machinery BitLocker ships with: TPM-backed auto-unlock, Windows Hello integration, and centrally escrowed recovery keys through Entra ID. Wiring TPM2 auto-unlock on Omarchy is a community guide, not a built-in feature. Worth noting too: the firewall was not enabled by default until version 3.1.0 — earlier installs shipped with none at all.
The one real scar, and it got fixed
From the project's start in June 2025 through version 4.0.0, the default install added the user
to the Linux docker group. Because the Docker daemon runs as root and anything in
that group can talk to its root-owned socket without a password, any process running as that
user — a compromised browser tab, a poisoned npm script, a malicious command run by an AI
coding agent — could escalate straight to root, bypassing the usual sudo prompt entirely.
It was reported by independent security researchers, and fixed in 4.0.1 (Aug 24, 2026) by
removing the default group membership. A cluster of smaller issues from the same period (shell
injection via video titles, command execution via desktop notifications, a predictable temp file
path in FIDO2 setup) drew the same criticism: unreviewed scripts processing untrusted input,
prioritizing speed over a security review pass. Disclosed, patched, and documented — which is
the honest state of it, not a reason to pretend it never happened.
What it is explicitly not for
- Not aimed at Linux newcomers. DHH has said so directly: Ubuntu is the easier landing for someone new to Linux. Omarchy suits people who already live in a terminal and want a curated, keyboard-driven desktop rather than one they configure themselves.
- Opinionated by design. Rooted in DHH's "Omakase" philosophy — one curated menu, not a buffet. Fighting the defaults for anything non-standard is swimming upstream on purpose.
- Marketed around AI coding agents as first-class citizens of the desktop, not as a general-purpose or enterprise workstation pitch.
Omarchy vs Windows, side by side
| Axis | Omarchy | Windows |
|---|---|---|
| Driver breadth | Strong on AMD/Intel and standard laptop hardware; real gaps on NVIDIA hybrid graphics and a handful of WiFi chipsets. | Broadest OEM coverage by a wide margin — vendors ship Windows drivers first. |
| Out of box software | Full native Linux stack; no native Adobe, Office, or AutoCAD, Wine/CrossOver with real caveats instead. | Native home turf for Adobe, Office, AutoCAD, and nearly all commercial software. |
| Gaming | Steam/Proton pre-wired; kernel anti-cheat titles are categorically blocked, publisher-dependent otherwise. | Universal compatibility, including every kernel-level anti-cheat title. |
| Enterprise fit | No AD join, MDM, or GPO equivalent — built for one workstation, not a fleet. | Native AD/Entra join, Intune, Group Policy, a mature VPN/SSO ecosystem. |
| Customization | Full source-level control over an open base, but the curated defaults push back on anything non-standard. | Deep control via registry/PowerShell, but enterprise lockdown exists specifically to remove end-user control. |
| Update model | Rolling release off Arch — always current, with the regression risk that implies; no LTS channel. | Staged channels including Enterprise LTSC; more conservative, centrally manageable. |
| Security defaults | Strong at-rest encryption by default; a disclosed root-escalation default shipped for over a year before being patched. | BitLocker with TPM-integrated, centrally escrowed keys; a much larger review apparatus, also a much larger target. |
| Learning curve | Steep for GUI-only users; near zero for anyone already comfortable in a terminal. | Familiar to nearly everyone already. |
The call for this build
The machine this is going on is a dedicated AI workstation, not a gaming rig, not an Adobe or AutoCAD box, and not a managed corporate endpoint — which is exactly the lane Omarchy is built for. The categories that would rule it out (kernel anti-cheat gaming, Creative Suite, enterprise fleet management) are not in play here. The categories worth actually watching before the install — hybrid-GPU laptop switching and fingerprint-after-suspend — mostly stop mattering on a stationary workstation with one GPU and no fingerprint reader in the loop. The docker-group issue is patched as of 4.0.1, and the current download is past that. Verdict: go. Flash the USB, turn off Secure Boot and TPM in the BIOS first, keep a wired keyboard on hand for the LUKS prompt, and take the backup before the full-disk option touches the drive.
Sources