First login: create docker group and add normal user to it

[igorpecovnik]

Description

This way we ensure, user is added to the Docker group even Docker is installed later.

The Docker package’s post-install script runs:

if ! getent group docker >/dev/null; then
    addgroup --system docker
fi

So since the group already exists → it does nothing.

Checklist:

• My code follows the style guidelines of this project
• My changes generate no new warnings

Summary by CodeRabbit

• New Features
  • New users now automatically receive Docker group membership during account creation.
  • If the Docker group is missing, the system attempts to create it and will emit a warning if creation fails, ensuring users get immediate membership when possible.

[coderabbitai]

Walkthrough

The add_user function in armbian-firstlogin now checks for the docker group (using getent), attempts to create it as a system group if missing (emitting a warning on failure), and includes docker in the supplementary-groups loop so the new user is added to it immediately after creation.

Changes

Cohort / File(s)	Summary
User group management packages/bsp/common/usr/lib/armbian/armbian-firstlogin	In add_user: added a pre-step that checks for the docker group via getent, creates docker as a system group if not present (with a warning on failure), and added docker to the list of supplementary groups appended to the new user.

Sequence Diagram(s)

sequenceDiagram
    participant Script as armbian-firstlogin
    participant Sys as System (groups, useradd)

    Script->>Sys: getent group docker?
    alt docker exists
        Sys-->>Script: group found
    else docker missing
        Script->>Sys: groupadd --system docker
        alt success
            Sys-->>Script: group created
        else failure
            Sys-->>Script: warning emitted
        end
    end
    Script->>Sys: useradd ... (create user)
    Script->>Sys: usermod -a -G docker,other_groups newuser
    Sys-->>Script: user updated (docker membership set)

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

• Single-file change with focused logic.
• Pay attention to: group creation command (flags), error/warning handling, and the supplementary-groups loop to ensure correct comma-separated formatting and ordering.

Poem

🐰 I dug a little group in the ground, neat and round,
A docker den where new users are found,
One check, one add, then a gentle nudge,
Every new account gets the docker hug! 🐳

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: creating a docker group and adding the normal user to it during first login, which directly matches the code modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch adddocker

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 5344eac and 8bc971f.

📒 Files selected for processing (1)

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Walkthrough

The armbian-firstlogin script is modified to automatically create a Docker system group if it doesn't exist and add the Docker group to the supplementary groups assigned to newly created user accounts.

Changes

Cohort / File(s)	Summary
User Docker Group Provisioning packages/bsp/common/usr/lib/armbian/armbian-firstlogin	Added logic to create a Docker system group if absent, and extended the supplementary groups list for new users to include the docker group alongside existing groups (sudo, netdev, audio, video, disk, tty, users, games, dialout, plugdev, input, bluetooth, systemd-journal, ssh, render).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Single file modification with straightforward additions
• Docker group creation is a simple conditional check
• Supplementary groups list extension is a straightforward append operation
• No complex logic or control flow changes introduced

Poem

🐰 A docker in the group, how splendid and fine!
The rabbits rejoice when first-login makes time,
To welcome new users with containers so bright,
With permissions all set and their systems just right! 🐳✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main change: creating a docker group and adding the normal user to it during first login setup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch adddocker

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between d7061f5 and 5344eac.

📒 Files selected for processing (1)

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin (1 hunks)

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: amazingfate
Repo: armbian/build PR: 8668
File: extensions/ufs.sh:2-2
Timestamp: 2025-09-24T09:54:07.968Z
Learning: In Armbian's build system, DOCKER_ARMBIAN_BASE_IMAGE must be set globally at file load time in extensions, not inside extension_prepare_config functions, because docker operations happen early in the build process and would default to ubuntu:noble if not set before docker_cli_prepare() runs.

Learnt from: tmshlvck
Repo: armbian/build PR: 8660
File: lib/functions/host/docker.sh:519-529
Timestamp: 2025-09-22T06:01:50.284Z
Learning: In the Armbian build framework's docker.sh, DOCKER_MOUNT_OPTS is conditionally set: empty for Docker, and ",suid,dev" for Podman to handle mount permission requirements.

Learnt from: tmshlvck
Repo: armbian/build PR: 8660
File: lib/functions/host/docker.sh:519-529
Timestamp: 2025-09-22T06:01:50.284Z
Learning: In the Armbian build framework's docker.sh, DOCKER_MOUNT_OPTS is conditionally set: empty for Docker, and ",suid,dev" for Podman to handle mount permission requirements.

📚 Learning: 2025-09-24T09:54:07.968Z

Learnt from: amazingfate
Repo: armbian/build PR: 8668
File: extensions/ufs.sh:2-2
Timestamp: 2025-09-24T09:54:07.968Z
Learning: In Armbian's build system, DOCKER_ARMBIAN_BASE_IMAGE must be set globally at file load time in extensions, not inside extension_prepare_config functions, because docker operations happen early in the build process and would default to ubuntu:noble if not set before docker_cli_prepare() runs.

Applied to files:

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin

📚 Learning: 2025-09-22T06:01:50.284Z

Learnt from: tmshlvck
Repo: armbian/build PR: 8660
File: lib/functions/host/docker.sh:519-529
Timestamp: 2025-09-22T06:01:50.284Z
Learning: In the Armbian build framework's docker.sh, DOCKER_MOUNT_OPTS is conditionally set: empty for Docker, and ",suid,dev" for Podman to handle mount permission requirements.

Applied to files:

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin

🔇 Additional comments (2)

packages/bsp/common/usr/lib/armbian/armbian-firstlogin (2)

608-610: LGTM! Docker group added to user supplementary groups.

The addition of docker to the supplementary groups list is correct and aligns with the PR objective. The user will be a member of the docker group even if Docker is installed later, avoiding the need for manual group assignment or re-login.

Note: The usermod command on line 609 silently ignores errors (2>/dev/null), so if the docker group creation failed on line 606, the user won't be added to the docker group without any visible error. This is consistent with how other groups are handled in this loop (since some groups may not exist on all system configurations), but worth being aware of.

---

604-607: The addgroup --system command is standard across Debian-based systems and the code pattern matches the script's established conventions.

The --system flag for addgroup is well-established and supported across all Debian/Ubuntu systems that Armbian targets. The review comment's reference to "unsupported flag" is incorrect.

Regarding error handling: the script intentionally suppresses errors throughout this function—all commands in the usermod loop use 2>/dev/null, and there are no error checks for other group additions (sudo, netdev, audio, etc.). The docker group creation follows the same pattern as the rest of the code. The getent check already provides idempotent protection against duplicate creation attempts.

The suggested error-logging diff introduces special-case handling for just one command, which is inconsistent with the function's established approach and would complicate the script unnecessarily.

Likely an incorrect or invalid review comment.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between d7061f5 and 5344eac.

📒 Files selected for processing (1)

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📓 Common learnings

Learnt from: amazingfate
Repo: armbian/build PR: 8668
File: extensions/ufs.sh:2-2
Timestamp: 2025-09-24T09:54:07.968Z
Learning: In Armbian's build system, DOCKER_ARMBIAN_BASE_IMAGE must be set globally at file load time in extensions, not inside extension_prepare_config functions, because docker operations happen early in the build process and would default to ubuntu:noble if not set before docker_cli_prepare() runs.

Learnt from: tmshlvck
Repo: armbian/build PR: 8660
File: lib/functions/host/docker.sh:519-529
Timestamp: 2025-09-22T06:01:50.284Z
Learning: In the Armbian build framework's docker.sh, DOCKER_MOUNT_OPTS is conditionally set: empty for Docker, and ",suid,dev" for Podman to handle mount permission requirements.

Learnt from: tmshlvck
Repo: armbian/build PR: 8660
File: lib/functions/host/docker.sh:519-529
Timestamp: 2025-09-22T06:01:50.284Z
Learning: In the Armbian build framework's docker.sh, DOCKER_MOUNT_OPTS is conditionally set: empty for Docker, and ",suid,dev" for Podman to handle mount permission requirements.

📚 Learning: 2025-09-24T09:54:07.968Z

Learnt from: amazingfate
Repo: armbian/build PR: 8668
File: extensions/ufs.sh:2-2
Timestamp: 2025-09-24T09:54:07.968Z
Learning: In Armbian's build system, DOCKER_ARMBIAN_BASE_IMAGE must be set globally at file load time in extensions, not inside extension_prepare_config functions, because docker operations happen early in the build process and would default to ubuntu:noble if not set before docker_cli_prepare() runs.

Applied to files:

• packages/bsp/common/usr/lib/armbian/armbian-firstlogin

🔇 Additional comments (1)

packages/bsp/common/usr/lib/armbian/armbian-firstlogin (1)

608-610: LGTM: Adding docker to default groups is consistent with existing pattern.

Adding docker to the supplementary groups list aligns with the existing approach of granting the user access to common system groups. Since the user is already added to the sudo group (line 608), they already have root-equivalent access, so docker group membership doesn't significantly change the security posture.

Note: The 2>/dev/null suppression on line 609 means that if the docker group creation fails above, the usermod command will silently skip adding the user to the docker group without alerting the user.