ACE: Loading group membership?

[krobertson]

Currently, the ACI specifies handling for an image to specify the user, group, and supplemental GIDs to use. However one discussion we had was whether group membership in /etc/groups should be automatically picked up from the filesystem. If the user/UID specified matches a valid user, then in addition to the explicit supplemental GIDs, should the groups the user is a member of also be loaded in? In our case, we were looking at simply calling initgroups().

[zquestz]

This seems like a good pattern to me. Ideally if I load an OS which contains /etc/groups I would expect that group to be respected by the container runtime.

[krobertson]

@jonboulle have any thoughts?

[jonboulle]

Seems reasonable, put up a PR and we can thrash out there?