# Inject default user/group for Docker by Nomad client **URL:** \ **Category:** Nomad\ **Created:** [December 15, 2020, 2:09am UTC](https://discuss.hashicorp.com/t/inject-default-user-group-for-docker-by-nomad-client/18895 "2020-12-15T02:09:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![RomanTheLegend](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/romanthelegend/32/15794_2.png) [@RomanTheLegend](https://discuss.hashicorp.com/u/RomanTheLegend)\ **Post date:** [December 15, 2020, 2:09am UTC](https://discuss.hashicorp.com/t/inject-default-user-group-for-docker-by-nomad-client/18895/1 "2020-12-15T02:09:29Z")
Hello, I’m trying to solve the following problem. Configuration: - A pipeline produces 2 artifacts: docker image and nomad job definition for it. Both are immutable, versioned and stored on artifact repo. There are reasons for such setup, but basically job definition should stay immutable. - Both artifacts are promoted through environments, each running under different users. **Problem** : I’d like to ensure that whichever environment the job is running in, that user will be the user who starts the process inside the container. First I looked at templating the user, but template stanza works only inside task stanza, while container user is defined in job stanza. Then I checked Docker plugin configuration on nomad client, but it doesn’t have an option to use default user either, thus USER statement from image is applied (or root if none) The user from the image doesn’t have privileges that nomad user does. This is definitely possible from Docker API perspective because docker-compose does exactly that (actually, it’s even better because it can use UID/GID only and unlike Nomad, doesn’t require the account to be pre-created inside the image) Furthermore, docker-compose v2 has “group\_add” statement, which would be really useful in Nomad as well… Is there any other way to achieve that apart from tinkering with entrypoints, sudoers and other impractical workarounds? ---
**Author:** ![tgross](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tgross/32/3015_2.png) [@tgross](https://discuss.hashicorp.com/u/tgross)\ **Post date:** [December 15, 2020, 1:15pm UTC](https://discuss.hashicorp.com/t/inject-default-user-group-for-docker-by-nomad-client/18895/2 "2020-12-15T13:15:00Z")
Hi @RomanTheLegend! Setting the user isn’t in the Docker config block because it’s provided at the task level. Try setting the task [`user`](https://www.nomadproject.io/docs/job-specification/task#user) in the job specification. We don’t currently support adding a group, but we do have an open PR from the community for it [#8066](https://github.com/hashicorp/nomad/pull/8066) which unfortunately is tied up in CLA signing legalities. ---
**Author:** ![RomanTheLegend](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/romanthelegend/32/15794_2.png) [@RomanTheLegend](https://discuss.hashicorp.com/u/RomanTheLegend)\ **Post date:** [December 15, 2020, 11:41pm UTC](https://discuss.hashicorp.com/t/inject-default-user-group-for-docker-by-nomad-client/18895/3 "2020-12-15T23:41:25Z")
Not exactly what I was asking, I’m more interested in scenario where username could be either templated from Consul’s KV or that I can preset default value inside Nomad Agent’s configs. Looks like there’s no such possibility as of yet ---
**Author:** ![tgross](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/tgross/32/3015_2.png) [@tgross](https://discuss.hashicorp.com/u/tgross)\ **Post date:** [December 16, 2020, 1:37pm UTC](https://discuss.hashicorp.com/t/inject-default-user-group-for-docker-by-nomad-client/18895/4 "2020-12-16T13:37:41Z")
Hm… you could most likely use HCL2’s [variables](https://www.nomadproject.io/docs/job-specification/hcl2/variables) and pass them in as a `NOMAD_VAR_foo` environment variable from wherever you’re submitting the jobs (i.e. your CI/CD system).