Thanks, that’s the kind of context I was hoping for. You hadn’t mentioned Jupyter Hub before.
There are some layers of stacked images involved. Here’s where the user is created, without assigning a primary group:
The last statement in that Dockerfile is USER $NB_UID. And the Dockerfile reference for USER says that if one switches to a user without a primary group assigned, the group root is used.
And here’s the part where the primary group is added, shortly after the container starts up:
The “user and group information for the specified USER” comes from configuration files such as /etc/group. That script modifies /etc/group, but the process executing the script won’t be affected. At least not to the point that its primary group changes while it’s running. So when you call id jovyan, you get the updated information from /etc/groups, but id shows the actual information of the running process.
The containers I work with are built from scratch, and the user I create there does have a primary group assigned in the Dockerfile. The results wouldn’t compare to yours.