Like the UID and GID, groups are a per-process credential. Each process has its own list of groups that it belongs to, which is initialized from /etc/group at login time (by the initial process that handles your login) but inherited from the parent process otherwise.
So when you run groups
from a shell, it inherits the group list from the shell (which has inherited them from the terminal app, etc) and that's the list it shows. The same applies to the UID and GID shown by id
(and in fact also to environment variables shown by env
). This list does not automatically change when /etc/group is updated – until the next time you log in.
Running groups SomeUser
or id SomeUser
, on the other hand, asks the program to read group information directly from /etc/group (in the same way that a login process would), so naturally it'll give you the updated list.
(User-switching tools like su
and sudo
also do the same, so if you urgently need to do something with a specific group you can "su" to root and then "su" back to yourself – su will reinitialize the group list as part of its job. You'll also notice that only the shell run by "su" has the new groups, while all other shells still show the old ones.)
To answer the question, yes, your account is in the "docker" group, but the specific shell you're running 'groups' from is not. Most things don't care about the account but only about the specific process that's performing the action (with some exceptions).
groups
without parameters.newgrp docker
after adding you to thedocker
group and you will be able ot rundocker
withoutsudo
without having to reopen the terminal/relogin