Many of us are now using NSS-managed systems. Pebble is built with CGO_ENABLED=0, which means Go's os/user package uses its pure-Go fallback that only reads passwd and group directly — it cannot query NSS/SSSD/LDAP.
This is unlikely to be an issue for charms, as Pebble is used to manage Kubernetes workload containers where it runs as root, rather than an NSS-managed user. This was noticed when running Pebble locally for testing purposes in charmlibs (canonical/charmlibs#487), but this is resolved by updating the test code to expect this limitation.
FWIW Concierge faced the same problem, which was resolved by using getent (canonical/concierge#183). That makes sense for Concierge (a classic confinement snap managing installation of other packages on arbitrary systems), but would not be the right approach for Pebble.
Perhaps resolving this is ultimately out of scope for Pebble's use cases, in which case it may be worth documenting the limitation.
Many of us are now using NSS-managed systems. Pebble is built with
CGO_ENABLED=0, which means Go's os/user package uses its pure-Go fallback that only readspasswdandgroupdirectly — it cannot query NSS/SSSD/LDAP.This is unlikely to be an issue for charms, as Pebble is used to manage Kubernetes workload containers where it runs as root, rather than an NSS-managed user. This was noticed when running Pebble locally for testing purposes in
charmlibs(canonical/charmlibs#487), but this is resolved by updating the test code to expect this limitation.FWIW Concierge faced the same problem, which was resolved by using
getent(canonical/concierge#183). That makes sense for Concierge (a classic confinement snap managing installation of other packages on arbitrary systems), but would not be the right approach for Pebble.Perhaps resolving this is ultimately out of scope for Pebble's use cases, in which case it may be worth documenting the limitation.