{"record":{"id":"bdc81f7a9677b14e","repo":"netbirdio/netbird","slug":"get-current-user-v","errorCode":null,"errorMessage":"get current user: %v","messagePattern":"get current user: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/debug.go","lineNumber":119,"sourceCode":"// via GetConfig, and prints the resulting GetConfigResponse as JSON\n// (via protojson with EmitUnpopulated=true so the output is stable\n// across runs and includes zero-valued fields).\n//\n// Useful for verifying MDM enforcement end-to-end: the response's\n// mDMManagedFields array is the single source of truth for \"which\n// fields is the daemon currently enforcing from the MDM source\", and\n// every config field side-by-side with that list confirms the merge\n// result. Secrets in the response (e.g. PreSharedKey) are already\n// redacted by the daemon-side handler.\nfunc debugConfigDump(cmd *cobra.Command, _ []string) error {\n\tpm := profilemanager.NewProfileManager()\n\tactiveProf, err := pm.GetActiveProfile()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get active profile: %v\", err)\n\t}\n\tcurrUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get current user: %v\", err)\n\t}\n\n\tconn, err := getClient(cmd)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer func() {\n\t\tif err := conn.Close(); err != nil {\n\t\t\tlog.Errorf(errCloseConnection, err)\n\t\t}\n\t}()\n\n\tclient := proto.NewDaemonServiceClient(conn)\n\tresp, err := client.GetConfig(cmd.Context(), &proto.GetConfigRequest{\n\t\tProfileName: string(activeProf.ID),\n\t\tUsername:    currUser.Username,\n\t})\n\tif err != nil {","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/debug.go#L101-L137","documentation":"debugConfigDump needs the calling user's name to include in the GetConfigRequest (the daemon keys some config lookups by user), and this wraps os/user.Current() failing. With cgo disabled — the normal case for the distributed static CLI — Current() falls back to parsing /etc/passwd and the environment, so it fails when the UID has no passwd entry and $USER/$HOME are not set, common in minimal containers.","triggerScenarios":"Running the CLI in a container with a numeric UID that has no /etc/passwd entry (docker run -u 1000123 without nsswitch/passwd setup); CI runners that scrub environment variables including USER and HOME; unusual NSS setups where the pure-Go resolver cannot enumerate the user; chroot without /etc/passwd mounted.","commonSituations":"Scratch/distroless containers invoking netbird CLI debug commands; Kubernetes securityContext runAsUser with a UID absent from the image passwd; hardened environments dropping env vars.","solutions":["Run the container with proper identity: add the user to /etc/passwd (getent/export passwd via docker --env or nss_wrapper), or run with a UID that exists in the image","Set the fallback env vars the pure-Go resolver uses: USER and HOME (e.g. -e USER=1000 -e HOME=/tmp) and retry","Where possible, run the debug dump on the host rather than inside a stripped container","If you control orchestration, prefer images that include /etc/passwd (non-scratch) for debugging tasks"],"exampleFix":"# before: numeric UID without a passwd entry\ndocker run --rm -u 1000123 netbird netbird debug config-dump\n# -> get current user: ...\n\n# after: provide identity explicitly\ndocker run --rm -u 1000123 -e USER=debug -e HOME=/tmp netbird netbird debug config-dump","handlingStrategy":"fallback","validationCode":"// Give the static binary the fallback identity it needs:\nif os.Getenv(\"USER\") == \"\" {\n    os.Setenv(\"USER\", strconv.Itoa(os.Getuid()))\n}\nif os.Getenv(\"HOME\") == \"\" {\n    os.Setenv(\"HOME\", \"/tmp\")\n}","typeGuard":null,"tryCatchPattern":"// Fall back to a synthesized username when the OS lookup fails:\ncurrUser, err := user.Current()\nif err != nil {\n    currUser = &user.User{Username: fmt.Sprintf(\"uid%d\", os.Getuid())}\n}","preventionTips":["In containers, always provide USER and HOME env or a passwd entry for the UID","Prefer non-scratch images for interactive debugging","Test CLI containers with the same UID they will run under in production"],"tags":["cli","environment","containers","passwd","debug"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}