Archived
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s
NixOS's group activation uses plain groupmod, which silently skips the GID change when SSSD exposes the same GID (50010) via the IPA docker-access group through NSS. Add an activation script that runs after the normal 'groups' step and applies groupmod --non-unique so the local docker group can share GID 50010 with the SSSD-provided IPA group. If the GID actually changes on a live system the script also restarts docker.socket + docker.service so the socket is recreated with the new GID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>