tailscale/tailscale · error

running 'id' command: %w

Error message

running 'id' command: %w

What it means

Fired in getGroupIdsWithId when the external `id -Gz` (or `id -G` on FreeBSD) command exits non-zero or errors; means the system `id` binary was unavailable, timed out (10s context), or failed for the given username/UID, so group IDs fall back to os/user.

Source

Thrown at util/osuser/group_ids.go:55

	if ids, err := getGroupIdsWithId(user.Username); err == nil {
		return ids, nil
	}
	return user.GroupIds()
}

func getGroupIdsWithId(usernameOrUID string) ([]string, error) {
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	cmd := exec.CommandContext(ctx, "id", "-Gz", usernameOrUID)
	if runtime.GOOS == "freebsd" {
		cmd = exec.CommandContext(ctx, "id", "-G", usernameOrUID)
	}

	out, err := cmd.CombinedOutput()
	if err != nil {
		return nil, fmt.Errorf("running 'id' command: %w", err)
	}

	return parseGroupIds(out), nil
}

func parseGroupIds(cmdOutput []byte) []string {
	s := strings.TrimSpace(string(cmdOutput))
	// Parse NUL-delimited output.
	if strings.ContainsRune(s, '\x00') {
		return strings.Split(strings.Trim(s, "\x00"), "\x00")
	}
	// Parse whitespace-delimited output.
	return strings.Fields(s)
}

View on GitHub (pinned to 6e0912f979)

Solutions

1. Fall back to user.GroupIds() as the caller does
2. Verify the `id` binary exists in PATH
3. Check the username/UID is valid on this system
4. Increase timeout if the system is slow to resolve users (e.g. LDAP/NSS)

When it happens

Trigger: Thrown at util/osuser/group_ids.go:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/59c489173d6fcf93. Report an issue: GitHub.