Repository: moby/moby (language: go)

Issue:
c8d/exec: `GroupAdd` isn't considered if setting `User`
### Description

With the containerd integration enabled, when running a container, extra groups (`docker run --group-add`) are not respected if user (`docker run --user`) is also specified.

### Reproduce

1. `docker run -d --name test --user root:root --group-add staff --group-add wheel --group-add audio --group-add 777 busybox top`
2. `docker exec test id`

### Expected behavior

Expected:
```
uid=0(root) gid=0(root) groups=0(root),10(wheel),29(audio),50(staff),777
```
Actual:
```
uid=0(root) gid=0(root) groups=0(root)
```

(however, if `--user root:root` is omitted from `docker run`, things work as expected)


### Additional Info

This is what's causing `TestDockerSwarmSuite/TestSwarmServiceWithGroup` (https://github.com/moby/moby/actions/runs/6614054276/job/17963338446?pr=46634) to fail.


Discussion / hints:

Fix patch:
diff --git a/daemon/exec_linux.go b/daemon/exec_linux.go
index 50864a9976b4f..488ab4853fe04 100644
--- a/daemon/exec_linux.go
+++ b/daemon/exec_linux.go
@@ -41,6 +41,7 @@ func getUserFromContainerd(ctx context.Context, containerdCli *containerd.Client
 		coci.WithUser(ec.User),
 		withResetAdditionalGIDs(),
 		coci.WithAdditionalGIDs(ec.User),
+		coci.WithAppendAdditionalGroups(ec.Container.HostConfig.GroupAdd...),
 	}
 	for _, opt := range opts {
 		if err := opt(ctx, containerdCli, &cinfo, spec); err != nil {


Test patch: