netbirdio/netbird · error

get current user: %v

Error message

get current user: %v

What it means

debugConfigDump needs the calling user's name to include in the GetConfigRequest (the daemon keys some config lookups by user), and this wraps os/user.Current() failing. With cgo disabled — the normal case for the distributed static CLI — Current() falls back to parsing /etc/passwd and the environment, so it fails when the UID has no passwd entry and $USER/$HOME are not set, common in minimal containers.

Source

Thrown at client/cmd/debug.go:119

// via GetConfig, and prints the resulting GetConfigResponse as JSON
// (via protojson with EmitUnpopulated=true so the output is stable
// across runs and includes zero-valued fields).
//
// Useful for verifying MDM enforcement end-to-end: the response's
// mDMManagedFields array is the single source of truth for "which
// fields is the daemon currently enforcing from the MDM source", and
// every config field side-by-side with that list confirms the merge
// result. Secrets in the response (e.g. PreSharedKey) are already
// redacted by the daemon-side handler.
func debugConfigDump(cmd *cobra.Command, _ []string) error {
	pm := profilemanager.NewProfileManager()
	activeProf, err := pm.GetActiveProfile()
	if err != nil {
		return fmt.Errorf("get active profile: %v", err)
	}
	currUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("get current user: %v", err)
	}

	conn, err := getClient(cmd)
	if err != nil {
		return err
	}
	defer func() {
		if err := conn.Close(); err != nil {
			log.Errorf(errCloseConnection, err)
		}
	}()

	client := proto.NewDaemonServiceClient(conn)
	resp, err := client.GetConfig(cmd.Context(), &proto.GetConfigRequest{
		ProfileName: string(activeProf.ID),
		Username:    currUser.Username,
	})
	if err != nil {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Run the container with proper identity: add the user to /etc/passwd (getent/export passwd via docker --env or nss_wrapper), or run with a UID that exists in the image
2. Set the fallback env vars the pure-Go resolver uses: USER and HOME (e.g. -e USER=1000 -e HOME=/tmp) and retry
3. Where possible, run the debug dump on the host rather than inside a stripped container
4. If you control orchestration, prefer images that include /etc/passwd (non-scratch) for debugging tasks

Example fix

# before: numeric UID without a passwd entry
docker run --rm -u 1000123 netbird netbird debug config-dump
# -> get current user: ...

# after: provide identity explicitly
docker run --rm -u 1000123 -e USER=debug -e HOME=/tmp netbird netbird debug config-dump

// Give the static binary the fallback identity it needs:
if os.Getenv("USER") == "" {
    os.Setenv("USER", strconv.Itoa(os.Getuid()))
}
if os.Getenv("HOME") == "" {
    os.Setenv("HOME", "/tmp")
}

// Fall back to a synthesized username when the OS lookup fails:
currUser, err := user.Current()
if err != nil {
    currUser = &user.User{Username: fmt.Sprintf("uid%d", os.Getuid())}
}

When it happens

Trigger: Running the CLI in a container with a numeric UID that has no /etc/passwd entry (docker run -u 1000123 without nsswitch/passwd setup); CI runners that scrub environment variables including USER and HOME; unusual NSS setups where the pure-Go resolver cannot enumerate the user; chroot without /etc/passwd mounted.

Common situations: Scratch/distroless containers invoking netbird CLI debug commands; Kubernetes securityContext runAsUser with a UID absent from the image passwd; hardened environments dropping env vars.

Related errors

• get active profile: %v
• failed to get config: %v
• upload failed: %s
• invalid persistence value: %s. Use 'on' or 'off'
• get active profile file path: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/bdc81f7a9677b14e. Report an issue: GitHub.