groupsList the groups a user belongs to
groups prints group names: for your current shell, or for any named user from the account database. It's the quickest way to answer 'am I in docker / sudo / adm yet?' when a permission error appears.
groups [USER]...Reading /var/log/syslog fails and you want to know whether you're in the adm group.
groupsPrints group names (coreutils). Equivalent to id -Gn.
groups is a thin wrapper around the same code as id -Gn. With no argument it calls getgroups() and getegid() on its own process, so it shows the groups your current shell actually carries, set at login by initgroups(). With user names it resolves each through NSS (getpwnam for the primary group, getgrouplist for the rest), which reads /etc/passwd and /etc/group or LDAP/SSSD. That difference is why groups and groups $USER can disagree right after someone runs usermod -aG: the database is updated immediately, the processes of an existing session never are.
(no argument)Groups of the current process (your shell)USER...Groups of each named user, from the account databaseid -GnSame list without the 'user :' prefixgetent group NAMECompanion: who is listed as a member of a groupnewgrp GROUPCompanion: start a shell with a newly added group activeRunning groups right after usermod -aG and concluding it failedWithout an argument, groups shows your existing session, which never picks up new groups.
groups $USER to check the database; log in again (or newgrp) to use the groupChecking membership with grep docker /etc/group onlyPrimary-group members aren't in the member list, and LDAP/SSSD users aren't in the file at all.
getent group docker and id -Gn USER (both go through NSS)Adding users to the docker group as a harmless convenienceDocker socket access lets you run a container with / mounted, which is root on the host.
Only trusted admins in docker; use rootless Docker or sudo rules for othersTry these on a Linux machine of your own. Each task has a hint and a solution.
Print your current groups, then the groups of root.
List the members of the adm group from the account database.
Add devops to a new group labteam, show that groups devops sees it but plain groups doesn't, then use newgrp to get it.
groupsList the groups a user belongs to
groups prints group names: for your current shell, or for any named user from the account database. It's the quickest way to answer 'am I in docker / sudo / adm yet?' when a permission error appears.
groups [USER]...Reading /var/log/syslog fails and you want to know whether you're in the adm group.
groupsPrints group names (coreutils). Equivalent to id -Gn.
groups is a thin wrapper around the same code as id -Gn. With no argument it calls getgroups() and getegid() on its own process, so it shows the groups your current shell actually carries, set at login by initgroups(). With user names it resolves each through NSS (getpwnam for the primary group, getgrouplist for the rest), which reads /etc/passwd and /etc/group or LDAP/SSSD. That difference is why groups and groups $USER can disagree right after someone runs usermod -aG: the database is updated immediately, the processes of an existing session never are.
(no argument)Groups of the current process (your shell)USER...Groups of each named user, from the account databaseid -GnSame list without the 'user :' prefixgetent group NAMECompanion: who is listed as a member of a groupnewgrp GROUPCompanion: start a shell with a newly added group activeRunning groups right after usermod -aG and concluding it failedWithout an argument, groups shows your existing session, which never picks up new groups.
groups $USER to check the database; log in again (or newgrp) to use the groupChecking membership with grep docker /etc/group onlyPrimary-group members aren't in the member list, and LDAP/SSSD users aren't in the file at all.
getent group docker and id -Gn USER (both go through NSS)Adding users to the docker group as a harmless convenienceDocker socket access lets you run a container with / mounted, which is root on the host.
Only trusted admins in docker; use rootless Docker or sudo rules for othersTry these on a Linux machine of your own. Each task has a hint and a solution.
Print your current groups, then the groups of root.
List the members of the adm group from the account database.
Add devops to a new group labteam, show that groups devops sees it but plain groups doesn't, then use newgrp to get it.