Add support for group_add in docker-compose

[moble]

As described here, support for the group_add option was removed for version 3.x files of docker-compose based on the fact that Swarm services did not support that option at the time. But that's no longer the case, so it would be very helpful if it could be added back in now. As seen here there is evidently some desire for this feature.

related:

• Support --group in docker service create moby/moby#25317 Support --group in docker service create
  • fixes docker service create --user does not support "group" / "gid" moby/moby#25304 docker service create --user does not support "group" / "gid"

[bartvanhoutte]

Any workarounds available?

[moble]

As mentioned here, one thing you can do is just to build the container, and add a RUN block to the Dockerfile with the relevant groupadd, useradd, and usermod commands — being sure to switch to USER root before that block, and back to whatever user it had been after that block.

[rulatir]

This is just absolutely awful. Docker and docker-compose developers randomly remove features without a word of explanation.

WHY did you remove this feature?

Oh, OF COURSE you will evade this by saying that the feature isn't technically removed, and you will be technically right. It is not removed, it is just limited to being used as part of a narrow and ancient feature set that is mutually exclusive with all the new features.

[dpkirchner]

The documentation says:

Removed: volume_driver, volumes_from, cpu_shares, cpu_quota, cpuset, mem_limit, memswap_limit, extends, group_add. See the upgrading guide for how to migrate away from these. (For more information on extends, see Extending services.)

However, the linked upgrading guide simply says that the group_add feature has been removed (at least in so far as it being unavailable as a stack), without providing an alternative. Is there an alternative that doesn't require modifying the image's Dockerfile?

[MrAlfabet]

This would be incredibly useful for media server containers.

[thatnerdjosh]

Is this currently being worked on?

[myaser]

what is the status now?

[Toilal]

The workaround provided by @moble doesn't seems to work, at least for the current version. After adding those commands inside Dockerfile, groups comand still displays the user primary group only, without docker group, and Permission denied occurs when trying to use the socket.

[abdennour]

@Toilal Same issue. Namely with MacOS.
Indeed, for linux is easier :

# Group ID of Docker Group on the Host
$(cat /etc/group | grep docker: | cut -d: -f3)

The result is the GID of docker group on the host which can be forwarded by env vars, which should be handled by the entrypoint.
But now, as we have Docker For Mac, we need --group-add staff to avoid the "Permission denied" when using docker-besides-docker

[AtanisZirkel]

Alternatives using modification of the docker file or the entrypoint are not appropriate when using a pre-build image (nextcloud in my case) as it might break some functionality in an uncontrolled way.

[avidspartan1]

Adding group_add back would be very useful for us.

[al-dpopowich]

Is this still an issue? group_add works for me:

$ docker-compose version
docker-compose version 1.27.4, build 40524192
docker-py version: 4.3.1
CPython version: 3.7.7
OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019

$ echo "$CONFIG" | docker-compose -f - config
services:
  foo:
    group_add:
    - 1000
    - 1001
    - 1002
    image: ubuntu
version: '3.8'

$ echo "$CONFIG" | docker-compose -p group_add -f - run  --rm foo /bin/bash -c id
Creating group_add_foo_run ... done
uid=0(root) gid=0(root) groups=0(root),1000,1001,1002

Is this another documentation error, but in reverse?

[brucedlg]

Since 1.27.0, version 2.x and version 3.x schema are merged.
The commit for the change is: docker/compose@b78c1ec#diff-804d766a83fc4fe189895e25fd0ecfcd64d47f06a28927297ab094ce71b42a06

So group_add is supported with 1.27.0+ docker-compose for all v2, v3 versions.
The parameter is documented in: https://github.com/compose-spec/compose-spec/blob/master/spec.md#group_add

[ndeloof]

Closing as implemented by compose-go