beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict #92

Merged
beatzaplenty merged 1 commits from worktree-parsed-mapping-raven into main 2026-07-28 08:19:53 +00:00
Conversation 0 Commits 1 Files Changed 1
+26
beatzaplenty commented 2026-07-28 08:19:49 +00:00
Owner
Copy Link
Copy Source

NixOS's group activation uses plain groupmod, which silently skips the
GID change when SSSD exposes the same GID (50010) via the IPA
docker-access group through NSS. Add an activation script that runs
after the normal 'groups' step and applies groupmod --non-unique so the
local docker group can share GID 50010 with the SSSD-provided IPA group.
If the GID actually changes on a live system the script also restarts
docker.socket + docker.service so the socket is recreated with the new
GID.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

NixOS's group activation uses plain groupmod, which silently skips the GID change when SSSD exposes the same GID (50010) via the IPA docker-access group through NSS. Add an activation script that runs after the normal 'groups' step and applies groupmod --non-unique so the local docker group can share GID 50010 with the SSSD-provided IPA group. If the GID actually changes on a live system the script also restarts docker.socket + docker.service so the socket is recreated with the new GID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-28 08:19:50 +00:00
fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s
Details
720399b00d 
NixOS's group activation uses plain groupmod, which silently skips the
GID change when SSSD exposes the same GID (50010) via the IPA
docker-access group through NSS.  Add an activation script that runs
after the normal 'groups' step and applies groupmod --non-unique so the
local docker group can share GID 50010 with the SSSD-provided IPA group.
If the GID actually changes on a live system the script also restarts
docker.socket + docker.service so the socket is recreated with the new
GID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit 164d14eb87 into main 2026-07-28 08:19:53 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#92