Dockarchy runs unsandboxed inside omarchy-shell, like every Omarchy plugin, and talks to Docker daemons you configured — some of them on other machines. This page says what it does with that access, where the trust boundaries are, and which limits protect the shell from a host that misbehaves.

• No privilege escalation of any kind: nothing runs as root, no policy files, no system services, no install scripts. The plugin is QML, JavaScript and a few bash scripts running as your user.
• No writes to your configuration except its own entry in ~/.config/omarchy/shell.json (through the shell's settings API) and, only when you run bin/dockarchy-menu install yourself, a marked block in ~/.config/omarchy/extensions/omarchy-menu.jsonc.
• No network access of its own beyond what you asked for: Docker/Podman sockets, your SSH hosts, and — for the image update check — the registries your images already come from. No telemetry.
• No credentials handled. SSH uses your keys and ~/.ssh/config; registry checks are anonymous HEAD requests, so private images simply show as unknown.

Everything in the "no" rows is treated as attacker-controlled: a compromised daemon or SSH peer can lie about containers, but it should not be able to run commands on your machine, inject markup, or exhaust the shell.

• Container ids, names, images, project names, services and directories are passed as separate argv entries, or single-quoted with a shell-quote helper when they must travel inside an ssh host '…' command line.
• SSH hosts are always preceded by --, so an endpoint whose host part starts with - cannot become an option.
• Clipboard copies use wl-copy -- <text>, no shell.
• Notification titles and bodies are markup-escaped: Omarchy's daemon renders body markup.
• Actions that touch state — kill, remove, pull & recreate — ask first, and the confirmation shows the exact command and host.

Every process the widget spawns runs under bin/dockarchy-exec, which caps stdout at a per-purpose ceiling and stderr at 64 KiB while streaming, and keeps a timeout. Truncated output is reported (exit 125), never parsed.

Remote polling deliberately runs docker ps/stats on the server through one ssh … bash -s session per host, rather than docker --context ssh://, whose one-SSH-session-per-API-call transport can trip sshd MaxSessions and fail2ban.

State kept in memory is bounded: stats history is capped per container (sparkSamples), notification debounce entries expire, and maps are rebuilt from each poll rather than appended to.

• ~/.cache/dockarchy/updates.json — last registry check (image names and digests) and problem.png / recovery.png — notification icons rendered in your theme's colours.
• Temporary directories from mktemp -d, removed on exit.

Open a private security advisory on the GitHub repository, or an issue if the problem is not sensitive. Reports like the ones that led to the limits above are very welcome.