Description

With latest rc5 it's not possible anymore, to use the spec.securityContext.fsGroup parameter together with spec.hostUsers: true. It seems, the parameter is just ignored.

Steps to reproduce the issue

1. deploy containerd2 rc.5 with latest kubelet
2. start a pod with hostUsers: true and fsGroup: 999
3. check inside of the pod the groups: id

Describe the results you received and expected

I would expect the following output within the pod (tested with prometheus container):

/prometheus $ id
uid=65534(nobody) gid=65534(nobody) groups=999,65534(nobody)

But get the following instead:

/prometheus $ id
uid=65534(nobody) gid=65534(nobody)

What version of containerd are you using?

containerd github.com/containerd/containerd/v2 v2.0.0-rc.5 05ee43a

Any other relevant information

Exactly the same setup is working as expected with containerd2 rc.4

Show configuration if it is related to CRI plugin.

No response