A Linux distribution that doesn't just run AI, it treats the AI as a user.
It is. And the numbers back up the interest, at least.
Daniel sent this one in. He's been watching Omarchy climb, and his read is that the interesting part isn't the popularity, it's the claim underneath it. Linux spawns distributions the way rivers spawn tributaries, hundreds of them, most of them variations on a theme. This one says something different: that agentic AI isn't an app you install on top of the operating system, it's a first-class citizen of the operating system itself.
Which is a much bigger claim than "we pre-installed Claude Code."
Right. And Daniel wants the practical version of that claim. What is Omarchy, why is it suddenly everywhere, what actually makes it different from the other nine hundred distros, and then the harder question: what does it mean in practice to integrate agentic AI at the center of a modern OS? What does that look like, and what are the real implications, good and bad, of baking it into the core rather than bolting it on?
Go.
Omarchy is an opinionated, open-source Linux distribution, MIT licensed, created by David Heinemeier Hansson. DHH. The Ruby on Rails guy, co-founder of 37signals, Basecamp. First release was June 26, 2025. It's now on version 4.0, codenamed Quattro, released August 14, 2026, and the current point release is 4.0.4.
A year old and on version four.
Aggressive release cadence, yeah. The stack is Arch Linux as the base, so rolling release, but pre-configured rather than a blank slate. Hyprland as the window manager, which is tiling and keyboard-first. And since 4.0, Quickshell, which is Qt Quick based, as a single long-running desktop shell process. That one process handles the bar, the launcher, menus, notifications, on-screen displays, control panels, the lock screen, the polkit agent. It replaced Waybar, Walker, Mako, SwayOSD, hyprlock, hypridle, swaybg, and polkit-gnome. Eight separate tools collapsed into one IPC-scriptable process with a plugin architecture.
IPC-scriptable is the phrase that matters there, isn't it.
It's the whole ballgame, and we'll get to why. The name comes from omakase, the Japanese term, chef's choice. The tagline is "the malleable OS for the age of agents."
Chef's choice. You don't pick, the chef picks, and you trust the chef.
The pitch is explicit about that. Linux, quote, "used to be a chore to setup, difficult to debug, and full of confusing upfront choices." Omarchy's answer is a fast install, curated defaults, and agents that debug the issues for you. The install can take as little as thirty-five seconds on fast hardware. Under two minutes typical.
Thirty-five seconds. My morning routine is longer than that and it's mostly lying still.
The adoption numbers are the reason Daniel noticed. One million, one hundred sixty-five thousand, nine hundred eighty ISO downloads in year one. About three hundred seventeen thousand in the last month alone. Roughly fifty-six hundred a day. And in late August, a hundred thousand downloads in a single week. Forty-two thousand GitHub stars, five thousand nine hundred sixty-nine pull requests, five hundred twenty-one contributors. DistroWatch popularity rank nineteen, about five hundred one hits a day.
Five hundred contributors on a project that's a year old.
And the money followed. The Omacom Foundation launched August 23, 2026. Eighteen point seven million dollars pledged as of September 17. It went from eight to ten to thirteen to eighteen point seven in under a month. Founding patrons at a million each: Tobi Lütke from Shopify, Patrick Collison from Stripe, Michael Dell, Jack Dorsey, Matthew Prince from Cloudflare, Drew Houston from Dropbox, Jason Fried, Brian Armstrong from Coinbase, and DHH himself.
Michael Dell personally, not Dell the company.
Dell the company did something else. They shipped day-one Omarchy support on the 2026 XPS 14 and 16, with a custom kernel carrying about twenty backports. Framework laptops are supported. Intel Macs install natively, the installer auto-applies Broadcom Wi-Fi fixes, SPI keyboard fixes, NVMe fixes, and they claim a thirty-six percent performance gain on a 2019 MacBook Pro versus macOS. There are new platform teams, Omarchy M for Apple hardware in September, Omarchy Dragon for Qualcomm Snapdragon. It runs on a 2011 ThinkPad X220 with two gigabytes of RAM.
A fifteen-year-old laptop with two gigs. That's the part I actually respect.
And the criticism got met head-on. There's a page on the project titled "Backed by the oligarchy," and a joke site at oligarchy dot fyi that says "Our shadowy agenda? Better Linux."
Naming your own attack before anyone else does. That's a move.
So that's what it is. The question Daniel's really asking is why this one is different, and the answer isn't the AI launchers. Any distribution can pre-install Claude Code. A skeptical reviewer said exactly that, that the AI-native label was just packaging. He's wrong, but he's wrong in an interesting way, because the differentiation sits underneath the launchers. Three decisions.
Take them one at a time.
Decision one. Every setting is a command, and every command is text. An agent cannot reliably click through a settings app. It can't see the window, it can't find the dropdown, it can't drag the slider. Omarchy exposes the entire system through a command-line tool called omarchy. You want to change the display text size, that's a command. You want to add a plugin, that's a command. You want to set your default agent, that's a command. And the configuration underneath is stored as plain text an agent can read and edit. Hyprland keybindings in Lua. The system menu in JSONC. Machine-specific overrides in shell dot toml.
So the settings app isn't the interface anymore. The text file is.
The text file always was, on Linux. Omarchy just stopped pretending otherwise and made the text file the supported path. The Quattro changelog reads like a list of things that used to be GUI-only and now have a command. That's the precondition for everything else. If the only way to change a thing is to click it, the agent can't do it. Full stop.
And that's true well beyond operating systems, isn't it. Any system you want an agent to operate has to be operable through text.
Which is decision two, and it's the one I find novel. The OS ships a skill alongside the manual. Omarchy installs a default skill file that explains to a coding agent how the system works and how to change it. And it symlinks that file into the skill directories of Claude Code, Codex, Pi, Antigravity, and the generic agents skills directory.
So it's not documentation for a human that the agent happens to read. It's documentation written for the agent.
Ubuntu has a manual. Omarchy has a manual and a skill, and the skill is what the agent reads. That's a real distinction. A manual tells a person where to click. A skill tells an agent what the system is, what the commands do, what it must never touch, and how to check its own work. It's a briefing.
A briefing. I like that framing. You hand the new guy the orientation packet before he touches anything.
And decision three is the one that makes the other two survivable. Undo is a feature of the operating system. The Limine bootloader takes a snapshot on every update. So a bad change is one reboot away from gone. Quattro moved Omarchy's own files into proper Arch packages, so distribution changes stay separate from user and agent changes. There's a factory reset command that reinstalls the configs. And the manual is blunt about it. Treat the skill as experimental. Run in plan mode first. And then be ready to roll back changes.
"Be ready to roll back changes" is not a sentence you write if you're confident.
It's an honest sentence. And it's the right one. The whole pattern, in one line: a generic distribution lets you install an agent as an application. Omarchy gives the agent a toolset in the CLI, a briefing in the skill, and a safety net in the snapshots, and then gets out of the way.
Toolset, briefing, safety net. That's the mechanism. What does it actually look like when you sit down at the thing?
Ten or more agent CLIs pre-wired. Claude Code, OpenAI Codex, OpenCode, Google's Antigravity CLI, GitHub Copilot CLI, Charmbracelet Crush, xAI's Grok CLI, Mario Zechner's Pi, Oh My Pi, and OpenRouter's harness. They're lazy-loaded through mise stubs in the local bin directory, so nothing downloads until you actually run one.
So the machine doesn't ship with ten agents installed. It ships knowing about ten agents.
On first boot there's a default agent picker. After that, a command sets it. Super plus Shift plus Control plus A launches your default agent in a dedicated terminal. There's a crash diagnosis path that I think is the cleanest example of the whole idea. Omarchy watches systemd coredump. If a process segfaults, you get a notification that says "Process crashed." You click it, and the crash dump is handed to your agent along with a diagnose-crash skill. The agent establishes the facts and decides whether it's worth reporting upstream. There's also a command to hand a crash to an agent by process ID.
So the debugging loop, which is the thing that makes Linux hard for normal people, is now a notification you click.
That's the pitch, and it's a good one. There's an agents panel in the top bar that tracks subscription usage across Claude Code, Codex, and Fireworks. Your plan, your percentage of the five-hour session limit, your weekly limit, token usage by day and by model. It regenerates every fifteen minutes and it can merge usage across multiple machines.
Merging usage across machines. That's a small feature that tells you who this is for.
It tells you the user has more than one machine and cares about the number. There's theme sync, so when you switch the desktop theme, the Claude Code, Pi, and OpenCode terminal themes follow. Agents can build apps, plugins, and themes through skills. LM Studio and Ollama install from the menu for local models. And there's a command that launches an agent straight into a task. You tell it to review a project and it opens already working.
Here's the part I want to sit on. You said the shortcuts launch agents in their auto-approving modes. The don't-stop-to-ask modes.
The manual warns about it directly. Quote: "be ready for them to actually do things."
Which is a wonderful sentence because it sounds like a warning and a promise at the same time.
It's both, and that's the hinge of the whole episode. Because the mechanism is elegant. The three decisions are correct, and I'll defend all three. But Omarchy 4.0 shipped on August 14, 2026 with serious flaws, and 4.0.1 on August 25 fixed eleven security items. Eleven, in eleven days.
Start with the worst one.
The Docker group escalation. Omarchy added every user to the docker group at install. And because supplementary groups are inherited by child processes, essentially every process in the user session could escalate to root. Not just Docker. The AI agents, the browser, the editor, the npm scripts. Anything running as that user. No password, no prompt.
So the agent didn't need to break out of anything. It was already inside.
That default persisted for about fourteen months. Four hundred thirty-three days. It was disclosed by a researcher going by 0xCC through responsible disclosure, and it got fixed.
Four hundred thirty-three days. That's not a bug that slipped through. That's a policy.
Then there's command injection through untrusted input, which is the pattern that repeats. A video's title could become the command that played the video. Notification click actions could run arbitrary shell. A USB device's name was executed as Hyprland Lua. An installed theme could run code. Every one of those is the same shape: something outside the machine supplies a string, and the string gets executed.
The title of a video.
The title of a video. And until 4.0.1, the cx and cy shortcuts started Claude Code and Codex with skip-all-permissions enabled. The first item in the 4.0.1 changelog reads: "Launch claude and codex agents with auto-review instead of full bypass."
So the operating system shipped a keyboard shortcut that launched an agent with every guardrail off, and the fix was to make it stop and ask.
That was the first line of the changelog. Not a footnote. The first line. And plugins run unsandboxed inside the long-lived shell process. The manual says so explicitly, in those words, while the plugin marketplace passed a thousand entries within a week of launch.
The manual tells you the plugins are unsandboxed and the marketplace hits a thousand in a week. Those two facts sitting next to each other is the whole tension of this project.
An earlier audit of version three found the firewall silently disabled, weak password rules, and ten sudo retries instead of three. Ten retries is not a security setting, that's a patience setting.
Ten retries is someone who got tired of typing their password.
There's a widely shared post called "Merchants of Insecurity" that argued all of this was the predictable result of AI-generated shell scripts handling untrusted input without review. A Framework community member asked for Omarchy to be removed from the laptop's install options. The Register called the desktop a bit clunky.
And here's the detail that makes it a story rather than a bug report. DHH has said Quattro was, quote, "virtually fully AI developed" over three months of prompting alongside Ryan Hughes. And then he says it's either a proof of the idea or a warning, depending on which paragraph you're reading.
He said that himself.
He said that himself. Which is either the most honest thing in the whole saga or the most carefully hedged. Probably both.
Now the counterpoint, because it's real and it matters. Omarchy's defaults today are better than the criticism suggests. Full-disk encryption is mandatory, LUKS. The firewall is on by default and blocks all inbound except LocalSend. SSH is off until you enable it. Packages are GPG-signed. Docker is locked down with ufw-docker. Passwordless sudo is a fifteen-minute toggle rather than a default. And there's a security team with a responsible disclosure process now, which there wasn't before.
So the scrutiny did the work.
Brodie Robertson made exactly that point. The scrutiny, quote, "inadvertently made it way more secure than it would have been if left alone."
Four hundred thirty-three days of a root escalation is a hell of a way to get a security team.
It is. And that's the honest accounting. The project is now more secure than it was, and it got there by being publicly embarrassed.
Which brings us to the fork in the road, because there are two answers to this and they're both serious.
Omarchy versus Ubuntu. Same destination, opposite routes. Omarchy's answer is malleability. Give the agent the whole machine, make everything scriptable, rely on snapshots when it goes wrong. Ubuntu 26.04 is the other one. Mark Shuttleworth called it "the OS for the agentic era," and the mechanism is Workshop, which sandboxes agents in LXD containers with snap confinement. The pitch is, quote, "you can run random code, from the internet, on your laptop, without handing it root."
That's containment. Don't give it the machine. Give it a box inside the machine.
Ubuntu 26.10 on October 15 adds opt-in agent-assisted troubleshooting. Fedora is heading the same direction with an AI OS proposal governed by SELinux and Podman.
And here's the thing. Malleability and containment pull in opposite directions. You cannot maximize both. Every bit of freedom you give the agent is a bit of surface you can't contain, and every bit of containment is a command the agent can't run.
Which is why the split is going to fall along the line of whose machine it is. On your own workstation, the blast radius is one laptop and you have snapshots. You want Omarchy's model. For anything touching customer data, the blast radius is the customer, and you want Ubuntu's model. Both of those are correct answers to different questions.
The engineering question for the next two years is how much of Omarchy's malleability survives inside Ubuntu's containment. And whether the answer is a hybrid nobody has built yet.
Nobody has built it. I don't know how you'd build it. But that's the shape of the problem.
Before we get to Hilbert, pull the lesson out. Because this is bigger than one distribution.
It is. Omarchy demonstrates a five-point checklist for making any system agent-operable. One: expose every action as a command or an API. If the only way to do it is to click, the agent can't. Two: keep configuration as text under version control. An agent can read a diff. It cannot read a screenshot of a settings page. Three: write the skill file. A short document that tells the agent what the system is, what the commands do, what it must never touch, and how to check its own work.
Four.
Four: build rollback in before you need it. The measure of a safe agent isn't how rarely it's wrong, it's how cheap its mistakes are to reverse. And five: decide what auto-approve means, in writing. Omarchy's answer changed between August 14 and August 25, 2026, and that change is the most instructive thing in the entire release history.
Five points, and only one of them is about the AI.
That's the part people miss. Four of the five are just good systems design that happened to be good for agents too.
Hilbert's been sitting on something about this one.
Hilbert: They're the right three decisions. CLI, skill, snapshots. I don't disagree with any of it.
Okay.
Hilbert: I did a stint as a night-shift sysadmin for a regional credit union. Late two-thousands. The whole job was babysitting a batch of shell scripts that ran as root on a schedule. Nothing else. That was the job. I'd come in at eleven, check the scripts had run, check the logs, go home at seven.
What were they doing?
Hilbert: Moving files. Posting interest. Generating statements. Reconciliation against the core system. Dull work, and it ran for eleven years without a single failure. Nobody touched them. Nobody needed to.
Eleven years.
Hilbert: The scripts had been written by a man who left the company years before I got there. Nobody understood them. I asked, twice, and both times got pointed at a binder. The only reason anything ever went wrong is that nothing ever went wrong. That's the whole story.
So what changed?
Hilbert: A new compliance officer asked a question nobody could answer. What exactly does the interest-posting script do if the core system is unavailable at two in the morning. Nobody knew. I didn't know. The man who wrote it was retired and living in Portugal. We had to read the scripts. Line by line, four of us, over about a week.
And what did you find?
Hilbert: That's not the point.
It's a little bit the point.
Hilbert: The point is that eleven years of working perfectly told us nothing about whether it was safe. Those are two different questions and we'd been treating them as one. The scripts weren't safe. They were just boring, and nobody was curious about anything boring.
That's the thing about an agent, though. It's not boring.
Hilbert: No, it's not. And that's worse, not better. An agent doesn't leave. It doesn't retire to Portugal. It does the same thing correctly every night for eleven years and nobody ever reads the log because the log is always clean. The failure mode isn't the agent doing something wrong. It's the agent doing something right, forever, in a way nobody audits.
Because it works.
Hilbert: Because it works. And "it works" and "it's safe" get confused when the thing doing the work is invisible. I've got the printout somewhere. The one we made that week.
What was in it?
Hilbert: I've got to move a trailer before it gets dark. The tarp's coming loose on the north side.
The five-point checklist is the thing I keep circling back to.
Because it generalizes past operating systems entirely. Every piece of software that wants an agent to operate it now has a design question it didn't have two years ago.
And the question is what, exactly. If the OS now has two users. One who reads text, cannot click, will occasionally be wrong, and needs a briefing, a toolset, and an undo button. What does that mean for how we build everything else?
Cloud First Consulting put it well, that Omarchy's lasting contribution may turn out to be the argument rather than the software. I think that's right. The argument is that an operating system has to be legible to a non-human user.
Legible to something that can't see.
Which is a strange sentence to say out loud, and it's going to be a normal sentence in about three years.
The open question for me is the one we can't answer yet. How much of Omarchy's malleability survives inside Ubuntu's containment, and whether the answer turns out to be a hybrid that nobody has built.
Somebody's building it right now and doesn't know it's the answer yet.
That's the show. Thanks to Hilbert Flumingtop for producing. This has been My Weird Prompts.
If you're not already subscribed, find us at my weird prompts dot com or in your podcast app of choice. We'll be back soon.
