Linux – Inconsistency between “getent group” and “getent group ” – why

getentgrouplinux

Question

How is the following possible?

$ getent group | grep docker
$ getent group docker
docker:x:600:

Note that the first call doesn’t return anything while the second one does.

grpck doesn’t report any issues.

Some Background

This is on a CentOS 7.6 VM that I have inherited from someone else, so I’m not sure where its configuration could potentially differ from the CentOS defaults. As far as I can tell, the VM is connected to LDAP somehow (but I’m not too familiar with this …).

Actually I wonder where this docker group is defined. At least it’s neither in /etc/group nor in /etc/gshadow.

As requested in the comments:

$ grep ^group /etc/nsswitch.conf
group:      files sss hesiod

Best Answer

@jeff-schaller’s comment got me on the right track: the docker group is defined in the Hesiod database:

$ hesinfo docker group
docker:x:600:

As @jeff-schaller and @stephen-kitt further pointed out, it appears that Hesiod doesn’t seem to allow to list all groups (hence getent group doesn’t return them) but allows to query them one-by-one (hence getent group docker returns the group).

Related Question