{"record":{"id":"b747bba05ec692a6","repo":"netbirdio/netbird","slug":"get-current-user-v-b747bb","errorCode":null,"errorMessage":"get current user: %v","messagePattern":"get current user: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/logout.go","lineNumber":42,"sourceCode":"\t\tctx, cancel := context.WithTimeout(cmd.Context(), time.Second*15)\n\t\tdefer cancel()\n\n\t\tconn, err := DialClientGRPCServer(ctx, daemonAddr)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"connect to daemon: %v\", err)\n\t\t}\n\t\tdefer conn.Close()\n\n\t\tdaemonClient := proto.NewDaemonServiceClient(conn)\n\n\t\treq := &proto.LogoutRequest{}\n\n\t\tif profileName != \"\" {\n\t\t\treq.ProfileName = &profileName\n\n\t\t\tcurrUser, err := user.Current()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"get current user: %v\", err)\n\t\t\t}\n\t\t\tusername := currUser.Username\n\t\t\treq.Username = &username\n\t\t}\n\n\t\tif _, err := daemonClient.Logout(ctx, req); err != nil {\n\t\t\treturn daemonCallError(\"deregister\", err)\n\t\t}\n\n\t\tcmd.Println(\"Deregistered successfully\")\n\t\treturn nil\n\t},\n}\n\nfunc init() {\n\tlogoutCmd.PersistentFlags().StringVar(&profileName, profileNameFlag, \"\", profileNameDesc)\n}\n","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/logout.go#L24-L60","documentation":"`netbird logout --profile <name>` failed to resolve the OS user running the CLI via os/user user.Current(). The username is sent with the LogoutRequest so the daemon can scope the deregistration to that user's profiles. In CGO-disabled builds (the released static binaries) Go falls back to parsing /etc/passwd (or getent), so a UID with no passwd entry fails here.","triggerScenarios":"Running the CLI as a UID that has no entry in /etc/passwd (container arbitrary-UID, systemd DynamicUser); /etc/passwd unreadable; NSS lookup failure in CGO builds; broken user database in a minimal container image.","commonSituations":"docker run -u 1000123 images without passwd entries; CI runners with synthetic UIDs; hardened/minimal images (distroless without passwd); running under a service account created after the image was built.","solutions":["Run the CLI as a real user with a passwd entry (e.g. `su - <user>` or fix `docker run -u`)","Add the current UID/GID to /etc/passwd and /etc/group in the container/host (useradd/nss-wrapper)","Verify with `id` and `getent passwd $(id -u)` that the lookup succeeds, then retry","If in a container, ensure /etc/passwd is mounted/readable and not shadowed"],"exampleFix":"# before (fails when UID has no passwd entry)\ndocker run --rm -u 12345 netbirdio/netbird logout --profile work\n# after (UID resolvable)\ndocker run --rm -u \"$(id -u):$(id -g)\" -v /etc/passwd:/etc/passwd:ro netbirdio/netbird logout --profile work","handlingStrategy":"validation","validationCode":"currUser, err := user.Current()\nif err != nil {\n    if runtime.GOOS == \"linux\" {\n        log.Printf(\"UID %d has no passwd entry; fix /etc/passwd or run as a real user\", os.Getuid())\n    }\n    return err\n}","typeGuard":"func userResolvable() bool {\n    _, err := user.Current()\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Run the CLI from real user sessions, not synthetic UIDs","In containers, add the runtime UID to /etc/passwd or bind-mount the host passwd","For scripts, preflight with `id -un` and fail with a clear message"],"tags":["os-user","environment","container","cli"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}