- What I did

Ensured that the addition of the user to the OCI spec runs before CDI injection. This is required to allow additional (non-root) group IDs to be added to the OCI spec if required for device nodes, for example. One case where this is applicable is on certain NVIDIA systems where device nodes have 660 permisions and are owned by root:video:

$ ls -al /dev/nvmap
crw-rw---- 1 root video 10, 124 Aug 26  2025 /dev/nvmap

This injection is equivalent with running docker with --group-add.

- How I did it

Reordered the functional modifers of the OCI spec so that WithUsers is called before WithDevices (which triggers CDI device injection).

- How to verify it

Create the following CDI spec at /var/run/cdi/additional-gid-test.yaml:

cdiVersion: "0.7.0"
kind: "example.com/device"
devices:
- name: foo
  containerEdits:
    additionalGids:
    - 1234

(also specified in the tests).

Running id in a container requesting the device should show the additional group:

$ docker run --rm -ti --device=example.com/device=foo alpine id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video),1234

(this is equivalent to running --group-add:

$ docker run --rm -ti --group-add 1234 alpine id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video),1234

(remove the created file).

- Human readable description for the release notes

Fix support for CDI specifications that request additional group IDs.

- A picture of a cute animal (not mandatory but encouraged)