containerd / containerd/containerd
Supplemental GID missing for group with same name as user
- Dominant language
- Go
- Stars
- 21.3k
- Forks
- 4.1k
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 92
Description
### Description
Originally, I observed this with a mongodb container. The image user is `mongodb` and there is a group `mongodb`, but it's not the primary group of the user (`nogroup` is). containerd omits the `mongodb` group from the supplemental GID list.
### Steps to reproduce the issue
1. Create a GCP Debian Bookworm VM.
2. Install latest k3s (v1.32.5+k3s1, comes with containerd v2.0.5-k3s1.32[^1]).
3. Apply a specially crafted reproducer (source: https://github.com/burgerdev/weird-images/tree/74b32e2/src/gid)
```sh
kubectl apply -f https://raw.githubusercontent.com/burgerdev/weird-images/74b32e268da916576f307f6f997ae289322f5aa6/src/gid/gid.yaml
```
[^1]: This was the simplest way for me to reproduce the bug. I know that it's a bit removed from upstream containerd main, but since I believe to have found the root cause (see last section), it may be sufficient as a demo.
### Describe the results you received and expected
#### Observed
In the container logs, I see the UID, GID and supplemental groups:
```raw
Uid: 2 2 2 2
Gid: 1 1 1 1
Groups: 1
```
#### Expected
The process should also have the supplemental group 2 (`name`).
### What version of containerd are you using?
v2.0.5-k3s1.32
### Any other relevant information
#### MongoDB setup
Image that I used when I discovered the bug: `quay.io/mongodb/mongodb-community-server@sha256:8b73733842da21b6bbb6df4d7b2449229bb3135d2ec8c6880314d88205772a11`
The unusual group setup comes from here, afaict:
https://github.com/mongodb/mongo/blob/cd9cc7450f3f665771a10f5c15f05bd6991c4d69/debian/mongodb-org-server.postinst#L25-L27
#### containerd bug
I assume it's this snippet that triggers the bug
https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L851-L854
The code seems to assume that a group with the same name as the user is always the primary group of the user.
It might be possible to just delete this check, given that the primary ID is always added
https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L833
but only if it hasn't been added already
https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L127-L135
### Show configuration if it is related to CRI plugin.
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.