{"record":{"id":"03ea803ebbcb4f7e","repo":"podman-container-tools/podman","slug":"execve-m","errorCode":null,"errorMessage":"execve: %m","messagePattern":"execve: %m","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libpod/container_top_linux.c","lineNumber":95,"sourceCode":"        {\n          // join the userns to make sure uid mapping match\n          // we are already part of the pidns so so pid 1 is the main container process\n          r = open (\"/proc/1/ns/user\", O_CLOEXEC | O_RDONLY);\n          if (r < 0)\n            {\n              fprintf (stderr, \"open /proc/1/ns/user: %m\");\n              exit (special_exit_code);\n            }\n          if ((status = setns (r, CLONE_NEWUSER)) < 0)\n            {\n              fprintf (stderr, \"setns NEWUSER: %m\");\n              exit (special_exit_code);\n            }\n        }\n\n      /* use execve to unset all env vars, we do not want to leak anything into the container */\n      execve (argv[0], argv, NULL);\n      fprintf (stderr, \"execve: %m\");\n      exit (special_exit_code);\n    }\n\n  r = waitpid (pid, &status, 0);\n  if (r < 0)\n    {\n      fprintf (stderr, \"waitpid: %m\");\n      exit (special_exit_code);\n    }\n  if (WIFEXITED (status))\n    exit (WEXITSTATUS (status));\n  if (WIFSIGNALED (status))\n    exit (128 + WTERMSIG (status));\n  exit (special_exit_code);\n}\n","sourceCodeStart":77,"sourceCodeEnd":111,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/libpod/container_top_linux.c#L77-L111","documentation":"execve(argv[0], argv, NULL) failed in the fork_exec_ps() child of 'podman top': the ps binary could not be executed. %m is strerror(errno): ENOENT (binary or its ELF interpreter/linker vanished or path wrong), EACCES (noexec mount, missing execute permission, path traversal denied), ENOEXEC, ETXTBSY, or ENOMEM. argv[0] is the ps path validated read-only moments earlier in podmanTopInner, so failures usually come from the mount environment (noexec) or dynamic-loader problems in a minimal image. Exit code 255 (special_exit_code).","triggerScenarios":"'podman top CTOR' where the ps binary sits on a noexec filesystem (image layers under a noexec overlay/tmpfs), the container image's ps is a dynamically linked binary whose loader/libs are absent, an architecture/ABI mismatch, or the path disappeared between validation and exec.","commonSituations":"Minimal images (distroless, busybox-based with a foreign ps copy) lacking libc/loader for ps; hosts mounting container storage with noexec (graphroot on a noexec partition); SELinux denying execution from container_file_t in unusual configurations.","solutions":["Verify ps works in the container directly: podman exec CTOR ps aux","Install procps in the image (e.g. RUN apt-get install -y procps or apk add procps) so a working ps ships with the image","Check container storage is not mounted noexec (findmnt -no OPTIONS /var/lib/containers/storage) and remount exec if safe","For SELinux denials, inspect ausearch -m avc and adjust labels/policy"],"exampleFix":"# before (Dockerfile)\nFROM alpine\nCOPY app /app\n\n# after\nFROM alpine\nRUN apk add --no-cache procps\nCOPY app /app","handlingStrategy":"validation","validationCode":"# Confirm the container's ps is executable before podman top uses it\n#!/bin/sh\nif podman exec \"$ctr\" sh -c 'command -v ps >/dev/null && ps --version >/dev/null 2>&1 || ps -V >/dev/null 2>&1' 2>/dev/null; then\n  exec podman top \"$ctr\"\nfi\necho \"ps not usable inside $ctr — install procps in the image\" >&2\nexit 1","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ship procps (ps) in images you intend to monitor with podman top","Keep container storage on exec-capable mounts — check findmnt for 'noexec' on /var/lib/containers/storage (or $CONTAINERS_STORAGE_CONF graphroot)","Smoke-test once after image build: podman run --rm IMAGE ps aux"],"tags":["podman-top","execve","ps","container-image"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}