I have a container from systemd-nspawn. The folder for the container /var/lib/machines/our-runner is owned by vu-our-runner-0:vg-our-runner-0. I am trying to serve files within it from the hosts apache2 instance, however, I cannot do usermod -aG vg-our-runner-0 www-data, as it says that vg-our-runner-0 does not exist, despite ls -ld saying otherwise. How would I give apache access to this short of running it as root (as root has access to the folders within the container)? The host is Debian, the container is Arch.

1 Answer 1


it says that vg-our-runner-0 does not exist, despite ls -ld saying otherwise

Well, those aren't the same thing. It is true that the group doesn't "exist" in /etc/group where usermod looks – it's a virtual group defined by systemd-machined. It is also true that the group "exists" when the getgrnam() or getgrid() functions are called by ls – because they collect information from more places than just /etc/group.

The /etc/passwd and /etc/group files are not only source of passwd & group information on Linux. When a program like ls -l tries to look up a group name or GID, multiple nsswitch modules can supply this information. (They're all listed in /etc/nsswitch.conf, and the 'libnss_files' module is what actually reads /etc/group.)

In particular, ls -l also asks the 'libnss_mymachines' module which is installed by systemd and provides information on the fly about currently running containers. It's also why the group suddenly stops being recognized when the container is stopped. (It's also why all vu-/vg- names stop being recognized whenever systemd-machined exits on idle...)

Fortunately, nsswitch has a special case for groups where it supports merging membership results from several modules; if you manually add this group to /etc/group, making sure to preserve its GID, then you will be able to add members to it.

So you could look up the GID using ls -ldn (e.g. 1164378112 in this case) and add a new line to /etc/group like this:

echo "vg-our-runner-0:x:1164378112:www-data" >> /etc/group

Now tools like id www-data or groups www-data (which collect group memberships through nsswitch) will report the new GID. It doesn't matter to the kernel where the group was defined – a GID is a GID.

  • ThanksI I've been able to add my own account and www-data to the group with your answer, however, I still cannot access its directory. Running namei -l /var/lib/machines/our-runner/ results in the following. So it seems like even though I am part of the vg-our-runner-0 group, I still strangely do not have access.
    – Kirna
    Jan 7 at 15:12
  • It also seems like both vu-our-runner-0 and vg-our-runner-0 have the same id of 73007104. Trying su vu-our-runner-0 as root also gives me an authentication error strangely enough.
    – Kirna
    Jan 7 at 15:20
  • 1
    You're not allowed to descend into the /var/lib/machines directory because you don't have the x permission on it. At this point, deeper permissions aren't even checked yet.
    – user1686
    Jan 7 at 15:26
  • Whoops! Thanks for your help! I'm kinda new to unix, so I don't have a clue what most attributes do. Resolved.
    – Kirna
    Jan 7 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.