# /etc/group.containers
# Source of truth for container service groups. Sync to all Docker VMs
# and the NFS server using sync-container-users.sh. Append-only — add new
# lines here when adding containers, never renumber existing ones.
#
# Primary per-app groups mirror passwd.containers UIDs (2000-2099).
# Shared groups start at 3000 for cross-container access.
# format: name:x:GID:secondary,members
2fauth:x:2000:
audiobookshelf:x:2001:
authelia:x:2002:
bazarr:x:2003:
cronjobs:x:2004:
dashy:x:2005:
dingus-archiver:x:2006:
finance-app:x:2007:
firefly3:x:2008:
gitea:x:2009:
gotify:x:2010:
immich:x:2011:
it-tools:x:2012:
jellyfin:x:2013:
joplin:x:2014:
kiwix:x:2015:
music-orchestrator:x:2016:
nginxproxy:x:2017:
ombi:x:2018:
picoshare:x:2019:
prowlarr:x:2020:
qbittorrent:x:2021:
radarr:x:2022:
romm:x:2023:
sonarr:x:2024:
tandoor_recipes:x:2025:
vault:x:2026:
#
# Shared groups (cross-container access, GID range 3000+)
# mediapipeline: *arr apps + qbittorrent + jellyfin share the media/download
# folders (e.g. /var/NFSFolder/AppData/media). Ombi is request-only (talks
# to APIs, doesn't touch the filesystem) so it's excluded.
mediapipeline:x:3000:bazarr,prowlarr,qbittorrent,radarr,sonarr,jellyfin
#
# finance-app and dingus-archiver are isolated custom apps with no shared
# access — their primary groups above (2007, 2006) already cover them.
# No secondary group needed unless that changes.