{"record":{"id":"129f6597f662a609","repo":"podman-container-tools/podman","slug":"cannot-setresgid-m","errorCode":null,"errorMessage":"cannot setresgid: %m\n","messagePattern":"cannot setresgid: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":926,"sourceCode":"          return;\n        }\n\n      /* This is a fatal error we can't recover from since we have already joined the userns.  */\n      join_namespace_or_die (\"mnt\", mntns_fd);\n\njoined:\n      sprintf (uid_fmt, \"%d\", uid);\n      sprintf (gid_fmt, \"%d\", gid);\n\n      setenv (\"_CONTAINERS_USERNS_CONFIGURED\", \"init\", 1);\n      setenv (\"_CONTAINERS_ROOTLESS_UID\", uid_fmt, 1);\n      setenv (\"_CONTAINERS_ROOTLESS_GID\", gid_fmt, 1);\n\n      /* We are in the user+mount namespace, these errors are not recoverable.  */\n\n      if (syscall_setresgid (0, 0, 0) < 0)\n        {\n          fprintf (stderr, \"cannot setresgid: %m\\n\");\n          _exit (EXIT_FAILURE);\n        }\n\n      if (syscall_setresuid (0, 0, 0) < 0)\n        {\n          fprintf (stderr, \"cannot setresuid: %m\\n\");\n          _exit (EXIT_FAILURE);\n        }\n\n      if (chdir (cwd) < 0)\n        {\n          fprintf (stderr, \"cannot chdir to %s: %m\\n\", cwd);\n          _exit (EXIT_FAILURE);\n        }\n\n      rootless_uid_init = uid;\n      rootless_gid_init = gid;\n    }","sourceCodeStart":908,"sourceCodeEnd":944,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L908-L944","documentation":"After successfully joining the existing user+mount namespaces via the shortcut, the preamble becomes 'root' inside the user namespace: setresgid(0,0,0) is called before setresuid (pkg/rootless/rootless_linux.c:923-929). The source comment marks these errors as not recoverable in the joined namespace, and the process _exits on failure. Typical errno is EPERM from a security policy (seccomp filtering setresgid, missing CAP_SETGID) or an incomplete GID mapping.","triggerScenarios":"Running rootless podman inside an unprivileged container whose seccomp profile or capability set blocks setresgid; a nested-userns environment where GID 0 is not mapped in the joined user namespace; AppArmor/LSM rules denying the syscall.","commonSituations":"Podman-in-podman / Docker-in-Docker setups running the inner podman without '--security-opt seccomp=unconfined' and proper caps; CI images that strip capabilities; security-hardened hosts restricting set*id syscalls.","solutions":["If nesting podman in a container, run the outer container with the documented rootless-in-container settings: '--security-opt seccomp=unconfined' --cap-add SETGID,SETUID or use the official podman-in-container guidance","Verify user namespace support works at all: 'unshare -Ur true' should succeed as the same user","Check sysctl kernel.unprivileged_userns_clone=1 (Debian/older Ubuntu) and user.max_user_namespaces > 0","If the environment is correct and it still fails, capture 'strace -f -e trace=setresgid podman <cmd>' and report upstream"],"exampleFix":"# before\n$ docker run --rm quay.io/podman/stable podman ps\ncannot setresgid: Operation not permitted\n\n# after\n$ docker run --rm --security-opt seccomp=unconfined --cap-add=SYS_ADMIN quay.io/podman/stable podman ps\n","handlingStrategy":"validation","validationCode":"# Verify the environment permits the set*id transition rootless podman needs\nif ! unshare -Ur true 2>/dev/null; then\n  echo \"user namespaces or setresgid/setresuid are blocked here\" >&2\n  exit 1\nfi\npodman \"$@\"\n","typeGuard":null,"tryCatchPattern":"if ! podman \"$@\"; then\n  rc=$?\n  # 'cannot setresgid: Operation not permitted' -> inspect the sandbox policy\n  unshare -Ur true || echo \"environment blocks set*id in user namespaces\" >&2\n  exit \"$rc\"\nfi","preventionTips":["When nesting podman in containers, follow the documented podman-in-container flags (seccomp=unconfined, needed caps)","Enable unprivileged user namespaces (kernel.unprivileged_userns_clone=1, user.max_user_namespaces>0)","Test base images with 'unshare -Ur id' before shipping them for rootless podman"],"tags":["userns","seccomp","rootless","permissions","container-nesting"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}