Question
How is the following possible?
$ getent group | grep docker
$ getent group docker
docker:x:600:
Note that the first call doesn’t return anything while the second one does.
grpck
doesn’t report any issues.
Some Background
This is on a CentOS 7.6 VM that I have inherited from someone else, so I’m not sure where its configuration could potentially differ from the CentOS defaults. As far as I can tell, the VM is connected to LDAP somehow (but I’m not too familiar with this …).
Actually I wonder where this docker
group is defined. At least it’s neither in /etc/group
nor in /etc/gshadow
.
As requested in the comments:
$ grep ^group /etc/nsswitch.conf
group: files sss hesiod
Best Answer
@jeff-schaller’s comment got me on the right track: the
docker
group is defined in the Hesiod database:As @jeff-schaller and @stephen-kitt further pointed out, it appears that Hesiod doesn’t seem to allow to list all groups (hence
getent group
doesn’t return them) but allows to query them one-by-one (hencegetent group docker
returns the group).