What does 999 mean here?

Solution 1:

If it can't show both the full username and group name in the space allotted, ls will replace one or both with the user or group ID instead rather than truncate either, in order to reduce or eliminate security issues due to similar user or group names with different length. It will not expand the column. You cannot change that.

Solution 2:

File don't have owner and group saved as names in their metadata, but as UID and GID.

If the OS cannot resolve those IDs to names, they show the ID as is.

The resolving process uses /etc/nsswitch.conf to know where to look. (file, ldap, database, etc.)

I suppose that getent group gitlab_ci will not return anything, meaning the group doesn't exist. If it doesn't that mean this group doesn't have GID 999 which explains why your file show bogus.

Use chgrp to modify its GID.

Solution 3:

I'm late to answer, but I've seen the 999 user used for MySQL in some distros. If your distro is not using the 999 user, then it is possible that the directory is shared with, or was copied from, another machine.

Just as an example, I have a 999 user in the following directory, for which no user exists on my machine:

$ ls -l mysql_data/
total 176188
-rw-rw---- 1 999 999       56 Jul 10 12:41 auto.cnf
-rw-rw---- 1 999 999 79691776 Jul 11 09:45 ibdata1
-rw-rw---- 1 999 999 50331648 Jul 11 09:45 ib_logfile0
-rw-rw---- 1 999 999 50331648 Jul 10 12:41 ib_logfile1
drwx------ 2 999 999    45056 Jul 10 17:03 magento
drwx------ 2 999 999     4096 Jul 10 12:41 mysql
drwx------ 2 999 999     4096 Jul 10 12:41 performance_schema

$ grep 999 /etc/passwd
$

But if we examine the Docker container which mounts this directory, we find:

$ docker-compose exec mysql grep 999 /etc/passwd
mysql:x:999:999::/home/mysql:

This container's image is the official Docker MySQL image:

$ grep -A1 -P "^\s*mysql:" docker-compose.yml
  mysql:
    image: mysql:5.6.40