containerd · AkihiroSuda · Jun 28, 2022 · Jun 16, 2022
diff --git a/README.md b/README.md
@@ -414,6 +414,7 @@ User flags:
 - :whale: :blue_square: `-u, --user`: Username or UID (format: <name|uid>[:<group|gid>])
 - :nerd_face: `--umask`: Set the umask inside the container. Defaults to 0022.
   Corresponds to Podman CLI.
+- :whale: `--group-add`: Add additional groups to join
 
 Security flags:
 - :whale: `--security-opt seccomp=<PROFILE_JSON_FILE>`: specify custom seccomp profile

diff --git a/cmd/nerdctl/run.go b/cmd/nerdctl/run.go
@@ -175,6 +175,7 @@ func setCreateFlags(cmd *cobra.Command) {
 	// user flags
 	cmd.Flags().StringP("user", "u", "", "Username or UID (format: <name|uid>[:<group|gid>])")
 	cmd.Flags().String("umask", "", "Set the umask inside the container. Defaults to 0022")
+	cmd.Flags().StringSlice("group-add", []string{}, "Add additional groups to join")
 
 	// #region security flags
 	cmd.Flags().StringArray("security-opt", []string{}, "Security options")
@@ -565,6 +566,12 @@ func createContainer(cmd *cobra.Command, ctx context.Context, client *containerd
 		opts = append(opts, uOpts...)
 	}
 
+	if gOpts, err := generateGroupsOpts(cmd); err != nil {
+		return nil, "", nil, err
+	} else {
+		opts = append(opts, gOpts...)
+	}
+
 	if umaskOpts, err := generateUmaskOpts(cmd); err != nil {
 		return nil, "", nil, err
 	} else {

diff --git a/cmd/nerdctl/run_user.go b/cmd/nerdctl/run_user.go
@@ -54,6 +54,18 @@ func generateUmaskOpts(cmd *cobra.Command) ([]oci.SpecOpts, error) {
 	return opts, nil
 }
 
+func generateGroupsOpts(cmd *cobra.Command) ([]oci.SpecOpts, error) {
+	var opts []oci.SpecOpts
+	groups, err := cmd.Flags().GetStringSlice("group-add")
+	if err != nil {
+		return nil, err
+	}
+	if len(groups) != 0 {
+		opts = append(opts, oci.WithAppendAdditionalGroups(groups...))
+	}
+	return opts, nil
+}
+
 func withResetAdditionalGIDs() oci.SpecOpts {
 	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *oci.Spec) error {
 		s.Process.User.AdditionalGids = nil

diff --git a/cmd/nerdctl/run_user_linux_test.go b/cmd/nerdctl/run_user_linux_test.go
@@ -52,3 +52,69 @@ func TestRunUmask(t *testing.T) {
 	testutil.DockerIncompatible(t)
 	base.Cmd("run", "--rm", "--umask", "0200", "busybox", "sh", "-c", "umask").AssertOutContains("0200")
 }
+
+func TestRunAddGroup(t *testing.T) {
+	t.Parallel()
+	base := testutil.NewBase(t)
+	testCases := []struct {
+		user     string
+		groups   []string
+		expected string
+	}{
+		{
+			user:     "",
+			groups:   []string{},
+			expected: "root bin daemon sys adm disk wheel floppy dialout tape video",
+		},
+		{
+			user:     "1000",
+			groups:   []string{},
+			expected: "root",
+		},
+		{
+			user:     "1000",
+			groups:   []string{"nogroup"},
+			expected: "root nogroup",
+		},
+		{
+			user:     "1000:wheel",
+			groups:   []string{"nogroup"},
+			expected: "wheel nogroup",
+		},
+		{
+			user:     "root",
+			groups:   []string{"nogroup"},
+			expected: "root bin daemon sys adm disk wheel floppy dialout tape video nogroup",
+		},
+		{
+			user:     "root:nogroup",
+			groups:   []string{"nogroup"},
+			expected: "nogroup",
+		},
+		{
+			user:     "guest",
+			groups:   []string{"root", "nogroup"},
+			expected: "users root nogroup",
+		},
+		{
+			user:     "guest:nogroup",
+			groups:   []string{"0"},
+			expected: "nogroup root",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.user, func(t *testing.T) {
+			t.Parallel()
+			cmd := []string{"run", "--rm"}
+			if testCase.user != "" {
+				cmd = append(cmd, "--user", testCase.user)
+			}
+			for _, group := range testCase.groups {
+				cmd = append(cmd, "--group-add", group)
+			}
+			cmd = append(cmd, testutil.AlpineImage, "id", "-nG")
+			base.Cmd(cmd...).AssertOutExactly(testCase.expected + "\n")
+		})
+	}
+}
diff --git a/go.mod b/go.mod
@@ -56,6 +56,7 @@ require (
 )
 
 require (
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Microsoft/hcsshim v0.9.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -180,7 +181,7 @@ require (
 
 replace (
 	// containerd main
-	github.com/containerd/containerd => github.com/containerd/containerd v1.6.1-0.20220616041926-9c6154bff158
+	github.com/containerd/containerd => github.com/containerd/containerd v1.6.1-0.20220621192144-0fac756b6452
 	// Temporary fork for avoiding importing patent-protected code: https://github.com/hashicorp/golang-lru/issues/73
 	github.com/hashicorp/golang-lru => github.com/ktock/golang-lru v0.5.5-0.20211029085301-ec551be6f75c
 	// Temporary fork lumberjack to support Maxbytes before releasing V3.0: https://github.com/natefinch/lumberjack/pull/132)

diff --git a/go.sum b/go.sum
@@ -45,6 +45,7 @@ dmitri.shuralyov.com/html/belt v0.0.0-20180602232347-f7d459c86be0/go.mod h1:JLBr
 dmitri.shuralyov.com/service/change v0.0.0-20181023043359-a85b471d5412/go.mod h1:a1inKt/atXimZ4Mv927x+r7UpyzRUf4emIoiiSC2TN4=
 dmitri.shuralyov.com/state v0.0.0-20180228185332-28bcc343414c/go.mod h1:0PRwlb0D6DFvNNtx+9ybjezNCa8XF0xaYcETyp6rHWU=
 git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGynbRyZ4dJvy6G277gSllfV2HJqblrnkyeyg=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8 h1:V8krnnfGj4pV65YLUm3C0/8bl7V5Nry2Pwvy3ru/wLc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
 github.com/AndreasBriese/bbloom v0.0.0-20180913140656-343706a395b7/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
 github.com/AndreasBriese/bbloom v0.0.0-20190306092124-e2d15f34fcf9/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
@@ -205,8 +206,8 @@ github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4q
 github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
 github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containerd/containerd v1.6.1-0.20220616041926-9c6154bff158 h1:F+XSDtasw2XVaRW7jD76Pz2wND55BKJNgH5/6ZRh9OE=
-github.com/containerd/containerd v1.6.1-0.20220616041926-9c6154bff158/go.mod h1:4EgLpeaCe0AgJ15QpNkPgh/DGaDo3zH1w1YoHtT0e5I=
+github.com/containerd/containerd v1.6.1-0.20220621192144-0fac756b6452 h1:0bGP/Bujaq2ujInrwPBFNUac9fe6p58Hl1DLPCB9K/8=
+github.com/containerd/containerd v1.6.1-0.20220621192144-0fac756b6452/go.mod h1:4EgLpeaCe0AgJ15QpNkPgh/DGaDo3zH1w1YoHtT0e5I=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
 github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
 github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=