podman: Error: cannot setup namespace using newuidmap: exit status 1
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
attempting to create any container rootlessly results in Error: cannot setup namespace using newuidmap: exit status 1
Steps to reproduce the issue:
1.run podman run docker.io/hello-world
Describe the results you received:
Error: cannot setup namespace using newuidmap: exit status 1
Describe the results you expected:
runs the docker-hello world container
Additional information you deem important (e.g. issue happens only occasionally):
Output of podman version:
`Error: cannot setup namespace using newuidmap: exit status 1`
running podman --version outputs
podman version 3.4.4
Output of podman info --debug:
host:
arch: amd64
buildahVersion: 1.23.1
cgroupControllers:
- cpuset
- cpu
- io
- memory
- hugetlb
- pids
- rdma
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: Unknown
path: /nix/store/6r9syknl9xza7jzwd25v0ym41rz84r1m-conmon-2.0.31/bin/conmon
version: 'conmon version 2.0.31, commit: '
cpus: 4
distribution:
codename: quokka
distribution: nixos
version: "22.05"
eventLogger: journald
hostname: nixpro
idMappings:
gidmap: null
uidmap: null
kernel: 5.10.84
linkmode: dynamic
logDriver: journald
memFree: 4878995456
memTotal: 8215441408
ociRuntime:
name: crun
package: Unknown
path: /nix/store/9m18pl5di2p0cin7b4wa1f55jk5fy5ka-crun-1.3/bin/crun
version: |-
crun version 1.3
commit: 1.3
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
os: linux
remoteSocket:
exists: true
path: /run/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_AUDIT_WRITE,CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_MKNOD,CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: false
seccompEnabled: true
seccompProfilePath: ""
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /nix/store/69rx44glqh00035mji5iw1dif6nxmlkv-slirp4netns-1.1.12/bin/slirp4netns
package: Unknown
version: |-
slirp4netns version 1.1.12
commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
libslirp: 4.6.1
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.2
swapFree: 4107718656
swapTotal: 4107718656
uptime: 13m 38.89s
plugins:
log:
- k8s-file
- none
- journald
network:
- bridge
- macvlan
volume:
- local
registries:
search:
- docker.io
- quay.io
store:
configFile: /etc/containers/storage.conf
containerStore:
number: 1
paused: 0
running: 0
stopped: 1
graphDriverName: overlay
graphOptions: {}
graphRoot: /var/lib/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "true"
Supports d_type: "true"
Using metacopy: "false"
imageStore:
number: 6
runRoot: /run/containers/storage
volumePath: /var/lib/containers/storage/volumes
version:
APIVersion: 3.4.4
Built: 315532800
BuiltTime: Tue Jan 1 05:30:00 1980
GitCommit: ""
GoVersion: go1.16.10
OsArch: linux/amd64
Version: 3.4.4
Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)
Yes
Additional environment details (AWS, VirtualBox, physical, etc.):
nixos unstable
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Reactions: 1
- Comments: 22 (10 by maintainers)
why do you have your user listed twice with the same range in the
/etc/subuidand/etc/subgidfiles?Can you drop one line from each file and make sure there are no overlapping mappings?
like:
I ran into this error on Podman 4.2 on Arch Linux. I resolved it after following the “Rootless Podman” setup steps on the Arch Wiki:
https://wiki.archlinux.org/title/Podman#Rootless_Podman
I’m not sure exactly what fixed it, but it seemed to start working after removing my
/etc/subuidand/etc/subgidfiles and running theusermodcommand there. The contents appear the same, except the range was extended was from 10,000 to 100,000 and there’s an extra blank line. Also, before the files were symlinked into my home dir and now they are not.@giuseppe, FWIW that’s the default in the latest stable podman image,
quay.io/podman/stable:v3.4.4.root doesn’t need
newuidmapandnewgidmapbecause it is already running with capabilitiesok, thanks.
Can you try the following commands?
Do they work fine?
/etc/subuid//etc/subgid/runseems to be mounted by nixos withnosuidhowever/run/wrappersis mounted withrw,nodev,relatime shared:13 - tmpfs tmpfs rw,mode=755unlike/runwhich is mounted/run rw,nosuid,nodev shared:11 - tmpfs tmpfs rw,size=2005724k,mode=755