Docker Engine (containerd-snapshotter enabled) fails to run Nydus image: "unable to find user root: no matching entries in passwd file" while nerdctl works

Problem

nerdctl --snapshotter nydus run ... works, but docker run ... fails after enabling Docker containerd-snapshotter + nydus snapshotter.

Expected behavior

Docker should run the nydus-converted image successfully, same as nerdctl.

Actual behavior

Docker fails with:

unable to find user root: no matching entries in passwd file

Repro steps

1. Start containerd-nydus-grpc:

containerd-nydus-grpc --nydusd-config /etc/nydus/nydus.json --log-to-stdout

/etc/nydus/nydus.json

{  
  "device": {  
    "backend": {  
      "type": "localfs",  
      "config": {  
        "dir": "/nfs/shared/liuyuxuan/nydus/data/"  
      }  
    },  
    "cache": {  
      "type": "blobcache",  
      "config": {  
        "work_dir": "/var/lib/containerd/io.containerd.snapshotter.v1.nydus/cache"  
      }  
    }  
  },  
  "mode": "direct",  
  "digest_validate": false,  
  "enable_xattr": true,  
  "fs_prefetch": {  
    "enable": true,  
    "threads_count": 4  
  }  
}  

2. Docker config /etc/docker/daemon.json:

{
  "features": { "containerd-snapshotter": true },
  "storage-driver": "nydus"
}

3. containerd config (system containerd) /etc/containerd/config.toml:

[proxy_plugins]
  [proxy_plugins.nydus]
    type = "snapshot"
    address = "/run/containerd-nydus/containerd-nydus-grpc.sock"

4. Run with nerdctl (works):

sudo nerdctl --snapshotter nydus run --net none -it cpp_ubuntu2204:v2-nydus ls /

5. Run with docker (fails):

sudo docker run --net none -it cpp_ubuntu2204:v2-nydus ls /

Environment

• OS: Ubuntu 24.04.3 LTS
• Kernel: 6.8.0-87-generic
• Docker: 29.1.3
• containerd (system): 2.2.1
• nydus: Version: v0.15.10

Question

How to configure Docker Engine to correctly use the nydus snapshotter (same behavior as nerdctl)?