mirror of
https://github.com/containers/podman.git
synced 2026-09-14 23:00:56 -04:00
Satwik Sai Prakash Sahoo
02f0ee0de0
When --group-add keep-groups (or GroupAdd=keep-groups in Quadlet) is used, supplementary groups are inherited from the calling process. When Podman is launched via a systemd user service, the calling process is the systemd --user manager, which only has the groups assigned to the user at the time the manager was started. If the user was added to new groups after the systemd user session started (e.g. via usermod), those groups will not be visible to the container. This is expected Linux process credential behavior, but was undocumented, causing confusion for Quadlet users. Add notes to both option and Quadlet docs explaining this behavior and the workaround (restarting the user's systemd manager). Fixes: #27876 Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>