run --user: reset additional GIDs

run_user.go

@@ -17,14 +17,24 @@
 package main
 
 import (
+	"context"
+
+	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
 	"github.com/urfave/cli/v2"
 )
 
 func generateUserOpts(clicontext *cli.Context) ([]oci.SpecOpts, error) {
 	var opts []oci.SpecOpts
 	if u := clicontext.String("user"); u != "" {
-		opts = append(opts, oci.WithUser(u), oci.WithAdditionalGIDs(u))
+		opts = append(opts, oci.WithUser(u), withResetAdditionalGIDs(), oci.WithAdditionalGIDs(u))
 	}
 	return opts, nil
 }
+
+func withResetAdditionalGIDs() oci.SpecOpts {
+	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
+		s.Process.User.AdditionalGids = nil
+		return nil
+	}
+}

run_user_test.go

@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package main
+
+import (
+	"testing"
+
+	"github.com/containerd/nerdctl/pkg/testutil"
+)
+
+func TestRunUserGID(t *testing.T) {
+	base := testutil.NewBase(t)
+	testCases := map[string]string{
+		"":       "root bin daemon sys adm disk wheel floppy dialout tape video",
+		"1000":   "root",
+		"guest":  "users",
+		"nobody": "nobody",
+	}
+	for userStr, expected := range testCases {
+		userStr := userStr
+		expected := expected
+		t.Run(userStr, func(t *testing.T) {
+			t.Parallel()
+			cmd := []string{"run", "--rm"}
+			if userStr != "" {
+				cmd = append(cmd, "--user", userStr)
+			}
+			cmd = append(cmd, testutil.AlpineImage, "id", "-nG")
+			base.Cmd(cmd...).AssertOut(expected)
+		})
+	}
+}