Inconsistency between “getent group” and “getent group <groupname>” – why?

# Question How is the following possible? $ getent group | grep docker $ getent group docker docker:x:600: Note that the first call doesn’t return anything while the second one does. grpck doesn’t report any issues. # Some Background This is on a CentOS 7.6 VM that I have inherited from someone else, so I’m not sure where its configuration could potentially differ from the CentOS defaults. As far as I can tell, the VM is connected to LDAP somehow (but I’m not too familiar with this …). Actually I wonder where this docker group is defined. At least it’s neither in /etc/group nor in /etc/gshadow. As requested in the comments: $ grep ^group /etc/nsswitch.conf group: files sss hesiod