fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict #92

Merged

beatzaplenty merged 1 commits from worktree-parsed-mapping-raven into main

2026-07-28 08:19:53 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	720399b00d	fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s Details NixOS's group activation uses plain groupmod, which silently skips the GID change when SSSD exposes the same GID (50010) via the IPA docker-access group through NSS. Add an activation script that runs after the normal 'groups' step and applies groupmod --non-unique so the local docker group can share GID 50010 with the SSSD-provided IPA group. If the GID actually changes on a live system the script also restarts docker.socket + docker.service so the socket is recreated with the new GID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 18:17:43 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

720399b00d

fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s

Details

NixOS's group activation uses plain groupmod, which silently skips the
GID change when SSSD exposes the same GID (50010) via the IPA
docker-access group through NSS.  Add an activation script that runs
after the normal 'groups' step and applies groupmod --non-unique so the
local docker group can share GID 50010 with the SSSD-provided IPA group.
If the GID actually changes on a live system the script also restarts
docker.socket + docker.service so the socket is recreated with the new
GID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 18:17:43 +10:00