containerd / containerd/containerd

Supplemental GID missing for group with same name as user

Open
#11,937 6 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
21.3k
Forks
4.1k
Avg merge
2d 4h
Merged PRs (30d)
92

Description

### Description

Originally, I observed this with a mongodb container. The image user is `mongodb` and there is a group `mongodb`, but it's not the primary group of the user (`nogroup` is). containerd omits the `mongodb` group from the supplemental GID list.

### Steps to reproduce the issue

1. Create a GCP Debian Bookworm VM.
2. Install latest k3s (v1.32.5+k3s1, comes with containerd v2.0.5-k3s1.32[^1]).
3. Apply a specially crafted reproducer (source: https://github.com/burgerdev/weird-images/tree/74b32e2/src/gid)
```sh
kubectl apply -f https://raw.githubusercontent.com/burgerdev/weird-images/74b32e268da916576f307f6f997ae289322f5aa6/src/gid/gid.yaml
```

[^1]: This was the simplest way for me to reproduce the bug. I know that it's a bit removed from upstream containerd main, but since I believe to have found the root cause (see last section), it may be sufficient as a demo.

### Describe the results you received and expected

#### Observed

In the container logs, I see the UID, GID and supplemental groups:

```raw
Uid: 2 2 2 2
Gid: 1 1 1 1
Groups: 1
```

#### Expected

The process should also have the supplemental group 2 (`name`).

### What version of containerd are you using?

v2.0.5-k3s1.32

### Any other relevant information

#### MongoDB setup

Image that I used when I discovered the bug: `quay.io/mongodb/mongodb-community-server@sha256:8b73733842da21b6bbb6df4d7b2449229bb3135d2ec8c6880314d88205772a11`

The unusual group setup comes from here, afaict:

https://github.com/mongodb/mongo/blob/cd9cc7450f3f665771a10f5c15f05bd6991c4d69/debian/mongodb-org-server.postinst#L25-L27

#### containerd bug

I assume it's this snippet that triggers the bug

https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L851-L854

The code seems to assume that a group with the same name as the user is always the primary group of the user.

It might be possible to just delete this check, given that the primary ID is always added

https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L833

but only if it hasn't been added already

https://github.com/containerd/containerd/blob/bcd000f443ef363b96e6dd4d67b4f6babfdef100/pkg/oci/spec_opts.go#L127-L135

### Show configuration if it is related to CRI plugin.

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.