This reads the local groups file directly.  When a system uses nis, ldap, kerberos, or whatever other central user database, docker cannot correctly enumerate group membership.  Only users listed in the local users file can connect to the unix socket.

I believe that getgroups() is the correct call for unix-like systems.  If I knew Go, I'd provide a patch, but I don't.