The fixed user seems to lose other groups

[Felipe Santos]

If the user is part of more groups than the dockergroup (the group which fixuid changes), those groups do not get applied in the new user.

[Caleb Lloyd]

Secondary groups are specified in /etc/groups in the 4th column, which is referenced by username

In the case the container is run with the UID of an existing user that does not match the name of the configured fixuid user, the UID is not changed, so secondary groups will not match:

fixuid/fixuid.go

Lines 138 to 147 in 4467c25

 } else { 
 	oldUID = "" 
 	newUID = "" 
 	if existingUser == containerUser { 
 		logInfo("runtime UID '" + runtimeUID + "' already matches container user '" + containerUser + "' UID") 
 	} else { 
 		logInfo("runtime UID '" + runtimeUID + "' matches existing user '" + existingUser + "'; not changing UID") 
 		needChown = true 
 	} 
 } 

But in the typical case that the container is run with a UID that does not match any user in /etc/passwd, the UID of the configured fixuid user will be changed, but the secondary groups from /etc/group will still match, since they are referenced by username

[Felipe Santos]

@caleblloyd so sorry, but I didn't understand much of your reply.

I'm back to say that, if a group is required to be present you can ensure its presence with docker run --group-add <group-name>, in my case docker run --group-add=docker.

[molohov]

This issue is still present.
Even if user is part of secondary groups in /etc/group, the user's groups only reflect what is set in /etc/fixuid/config.yml. You can verify this by running groups
Running with @felipecrs workaround will make the group present in the output of groups

[Aigars Mahinovs]

The problem lies in the ExitOrExec function that is executing the next process after doing all the changes. It is setting the euid and egid, but not looking up and setting additional groups from /etc/group from inside the container.

[Caleb Lloyd]

@aigarius good catch - it was not recomputing /etc/passwd and /etc/group - opened #37 to address

[Felipe Santos]

With this fix I was able to greatly simplify fixdockergid and drop the dependency on setpriv for it. Thanks a lot!

felipecrs/fixdockergid@ce80584