I think this is a bug.

Container's app user get the new GID created for the group conflicting with HOST GID.

I'm using method 2 with a Docker file for Postgres (version 15).

Host UID:GID is 510:20.
Container's app account (a config.yaml is used) is postgres, initially UID:GID = 999:999

Initially the container's /etc/group has dial out:x:20:

I expect the following result:

/etc/passwd : 
    postgres:x:501:20::/var/lib/postgresql:/bin/bash
/etc/group : 
    dialout:x:23:
    postgres:x:20:

but the result is:

/etc/passwd : 
    postgres:x:501:23::/var/lib/postgresql:/bin/bash
/etc/group : 
    dialout:x:23:
    postgres:x:20:

In other words, group definitions in /etc/group are OK, but app user definition is KO : it uses GID value of 23 instead of GID value of 20.

In the following traces, /etc/passwd is modified correctly the first time, but the second time, the primary GID of user postgres is set to the new GID of conflicting group dialout (23) instead of the wanted GID of HOST (20).

matchhostfsowner.postgres-trace.log

I think the traces speak for themselves, but I can provide more information on my setup (Dockerfile, docker compose file, script, etc) if needed.