From 4e1e1b206dd2072925340439acfee630747dce75 Mon Sep 17 00:00:00 2001
From: Viorel Munteanu <viorel@ceamac.ro>
Date: Fri, 21 Aug 2026 07:18:23 +0000
Subject: [PATCH] Split OciImageConfig's user into separate user/group fields

--user/--group are now handled as separate strings (ResolvedUser), so
parse config.User's "<user>[:<group>]" the same way instead of leaving
callers to split the combined spec themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz
---
 src/oci_image.cpp | 9 ++++++++-
 src/oci_image.h   | 3 ++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/oci_image.cpp b/src/oci_image.cpp
index ffbf7b3..1afccd0 100644
--- a/src/oci_image.cpp
+++ b/src/oci_image.cpp
@@ -368,7 +368,14 @@ std::optional<OciImageConfig> read_oci_image_config(const std::filesystem::path&
     try {
         json runtime_config = config_json.value("config", json::object());
 
-        result.user = runtime_config.value("User", "");
+        std::string user_spec = runtime_config.value("User", "");
+        auto colon_pos = user_spec.find(':');
+        if (colon_pos == std::string::npos) {
+            result.user = user_spec;
+        } else {
+            result.user = user_spec.substr(0, colon_pos);
+            result.group = user_spec.substr(colon_pos + 1);
+        }
 
         json exposed_ports = runtime_config.value("ExposedPorts", json::object());
         if (exposed_ports.is_object()) {
diff --git a/src/oci_image.h b/src/oci_image.h
index 9fb2178..be5c6b9 100644
--- a/src/oci_image.h
+++ b/src/oci_image.h
@@ -66,7 +66,8 @@ struct OciExposedPort {
 };
 
 struct OciImageConfig {
-    std::string user;                          // config.User, e.g. "git:git"; empty if unset
+    std::string user;                          // config.User's "<user>" part; empty if unset
+    std::string group;                         // config.User's optional ":<group>" part; empty if unset
     std::vector<OciExposedPort> exposed_ports;  // config.ExposedPorts keys, parsed "<port>/<proto>"
     std::vector<std::string> env;               // config.Env, e.g. "PATH=..."
     std::vector<std::string> volumes;           // config.Volumes keys, e.g. "/var/lib/mysql"