Why do `groups` and `groups $USER` give different results?

Question

I want to add myself to the "docker" group. These are the commands I ran, and their output:

user1@laptop-p3510:~$ sudo usermod -a -G docker user1
user1@laptop-p3510:~$ groups
user1 adm cdrom sudo dip plugdev lpadmin lxd sambashare
user1@laptop-p3510:~$ whoami
user1
user1@laptop-p3510:~$ groups user1
user1 : user1 adm cdrom sudo dip plugdev lpadmin lxd sambashare docker

Am I in the "docker" group or not? Why does groups $USER give different results than groups?

Answer 1

Because you need to log out and back in again for the added groups to be active.

groups returns the groups you are a member of for the current session

groups user1 checks to see what the config says that user is a member of.

Because you added user1 to a group and you have not yet logged out and back in again, the groups user1 was a member of when you logged in are the ones that current session will use.

Hope that helps

Answer 2

Like the UID and GID, groups are a per-process credential. Each process has its own list of groups that it belongs to, which is initialized from /etc/group at login time (by the initial process that handles your login) but inherited from the parent process otherwise.

So when you run groups from a shell, it inherits the group list from the shell (which has inherited them from the terminal app, etc) and that's the list it shows. The same applies to the UID and GID shown by id (and in fact also to environment variables shown by env). This list does not automatically change when /etc/group is updated – until the next time you log in.

Running groups SomeUser or id SomeUser, on the other hand, asks the program to read group information directly from /etc/group (in the same way that a login process would), so naturally it'll give you the updated list.

(User-switching tools like su and sudo also do the same, so if you urgently need to do something with a specific group you can "su" to root and then "su" back to yourself – su will reinitialize the group list as part of its job. You'll also notice that only the shell run by "su" has the new groups, while all other shells still show the old ones.)

To answer the question, yes, your account is in the "docker" group, but the specific shell you're running 'groups' from is not. Most things don't care about the account but only about the specific process that's performing the action (with some exceptions).