The host only ever adds groups, so the container runtime's module can put the operator in its group while the shell's module sets the same account's shell.
