From 13436c0c317fe353f93f0ac5135d1d8a3ac940b4 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Tue, 1 Sep 2026 19:17:39 +0800
Subject: [PATCH] fix(security): remove container daemon group access

---
 modules/nixos/base/user-group.nix                         | 2 --
 .../tests/security-container-groups/expected.nix          | 4 ++++
 .../x86_64-linux/tests/security-container-groups/expr.nix | 8 ++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 outputs/x86_64-linux/tests/security-container-groups/expected.nix
 create mode 100644 outputs/x86_64-linux/tests/security-container-groups/expr.nix

diff --git a/modules/nixos/base/user-group.nix b/modules/nixos/base/user-group.nix
index 23cc2efa..32853fa4 100644
--- a/modules/nixos/base/user-group.nix
+++ b/modules/nixos/base/user-group.nix
@@ -34,8 +34,6 @@
       "users"
       "wheel"
       "networkmanager" # for nmtui / nm-connection-editor
-      "podman"
-      "docker"
       "wireshark"
       "adbusers" # android debugging
       "libvirtd" # virt-viewer / qemu
diff --git a/outputs/x86_64-linux/tests/security-container-groups/expected.nix b/outputs/x86_64-linux/tests/security-container-groups/expected.nix
new file mode 100644
index 00000000..9b900579
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-container-groups/expected.nix
@@ -0,0 +1,4 @@
+{
+  userHasDockerAccess = false;
+  userHasPodmanAccess = false;
+}
diff --git a/outputs/x86_64-linux/tests/security-container-groups/expr.nix b/outputs/x86_64-linux/tests/security-container-groups/expr.nix
new file mode 100644
index 00000000..25738d8c
--- /dev/null
+++ b/outputs/x86_64-linux/tests/security-container-groups/expr.nix
@@ -0,0 +1,8 @@
+{ outputs, ... }:
+let
+  userGroups = outputs.nixosConfigurations.ai-niri.config.users.users.ryan.extraGroups;
+in
+{
+  userHasDockerAccess = builtins.elem "docker" userGroups;
+  userHasPodmanAccess = builtins.elem "podman" userGroups;
+}