Unlike docker run, the --user flag for services does not currently support :group or :gid, so the following will currently fail:

docker service  create --user 123:456 --name foobar nginx

I think we should either support the same syntax as on docker run, or provide a --group / --gid flag

/cc @stevvooe @aluzzardi