The s6-envuidgid program

s6-envuidgid sets the UID, GID and GIDLIST environment variables, then executes into another program.

Interface

     s6-envuidgid [ -g ] [ -i | -D uid:gid ] account prog...

s6-envuidgid looks account up by name in the account database.
It sets the UID environment variable to account's uid, and the GID environment variable to account's gid.
It also sets the GIDLIST environment variable to a comma-separated list of supplementary group ids account is a member of according to the group database. (If account doesn't belong to any other group than its primary group, GIDLIST is still set, but empty.)
Then it executes into prog....

-g : group. account will be interpreted as a group name instead of a user name; the GID environment variable will be set to its numerical value, and the UID and GIDLIST variables will not be touched.
-i : insist. If account is unknown, exit 1 with an error message. This is the default.
-D uid:gid : if account is unknown, use uid, gid, and the empty list as the values for UID, GID and GIDLIST.

s6-envuidgid without options behaves like envuidgid, except that the exit code is 1 if account doesn't exist.
s6-envuidgid is useful when running a program that must start as root but can drop its privileges later. Such a program can read its new uid/gid/groups info from the UID, GID and GIDLIST environment variables. Superservers such as s6-tcpserver4 make use of this.