{"record":{"id":"16474743214cab37","repo":"podman-container-tools/podman","slug":"cannot-clone-m-n","errorCode":null,"errorMessage":"cannot clone: %m\\n","messagePattern":"cannot clone: %m\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1311,"sourceCode":"  pid_t pid;\n  char b;\n  char uid[16];\n  char gid[16];\n\n  cwd = getcwd (NULL, 0);\n  if (cwd == NULL)\n    {\n      fprintf (stderr, \"error getting current working directory: %m\\n\");\n      _exit (EXIT_FAILURE);\n    }\n\n  sprintf (uid, \"%d\", geteuid ());\n  sprintf (gid, \"%d\", getegid ());\n\n  pid = syscall_clone (CLONE_NEWUSER|CLONE_NEWNS|SIGCHLD, NULL);\n  if (pid < 0)\n    {\n      fprintf (stderr, \"cannot clone: %m\\n\");\n      check_proc_sys_userns_file (_max_user_namespaces);\n      check_proc_sys_userns_file (_unprivileged_user_namespaces);\n    }\n  if (pid)\n    {\n      if (do_socket_activation)\n        {\n          long num_fds;\n\n          num_fds = strtol (saved_systemd_listen_fds, NULL, 10);\n          if (num_fds != LONG_MIN && num_fds != LONG_MAX)\n            {\n              int f;\n\n              for (f = 3; f < num_fds + 3; f++)\n                if (is_fd_inherited (f))\n                  close (f);\n            }","sourceCodeStart":1293,"sourceCodeEnd":1329,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1293-L1329","documentation":"In reexec_in_user_namespace, syscall_clone(CLONE_NEWUSER|CLONE_NEWNS|SIGCHLD, NULL) — creating the user+mount namespace pair that the entire rootless podman model rests on — returned < 0. %m is usually 'Operation not permitted' (EPERM); the failure is immediately followed by the sysctl hint from error 56. This kills rootless startup before anything else happens; it is the canonical 'rootless podman cannot create user namespace' error.","triggerScenarios":"user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0; seccomp profiles or AppArmor (e.g. Ubuntu 23.10+ kernel.apparmor_restrict_unprivileged_userns=1) denying clone with CLONE_NEWUSER; running inside an unprivileged outer container/CI sandbox; EAGAIN/'Resource temporarily unavailable' when the per-user namespace count or pid limits are exhausted; nesting-depth limits.","commonSituations":"podman-in-docker without userns privileges; hardened enterprise hosts; gVisor/runsc sandboxes; freshly installed distros with restricted userns defaults; CI images with strict seccomp.","solutions":["Read the following hint line (error 56) and fix the named sysctl: sysctl -w user.max_user_namespaces=28633 and, where present, kernel.unprivileged_userns_clone=1","Verify quickly: unshare --user --map-root-user true — if that fails, the host (not podman) blocks userns","On Ubuntu 23.10+ with AppArmor restriction, use the distro podman package with its AppArmor profile or set kernel.apparmor_restrict_unprivileged_userns=0","Inside a container, run the outer container with privileges that permit userns (rootless podman-in-podman per docs, or --privileged) — or use sudo podman","If errno is EAGAIN, check /proc/sys/user/max_user_namespaces usage and process/pid limits, and clear leaked namespaces"],"exampleFix":"# before\n$ podman info\ncannot clone: Operation not permitted\nuser namespaces are not enabled in /proc/sys/user/max_user_namespaces\n\n# after\n# sysctl -w user.max_user_namespaces=28633\n# echo 'user.max_user_namespaces = 28633' > /etc/sysctl.d/99-userns.conf\n$ podman info   # succeeds","handlingStrategy":"validation","validationCode":"# host must permit unprivileged userns before rootless podman can work\nsysctl user.max_user_namespaces kernel.unprivileged_userns_clone 2>/dev/null\nunshare --user --map-root-user true && echo \"userns OK\" || echo \"userns blocked (sysctl, seccomp or LSM)\"","typeGuard":null,"tryCatchPattern":"# in automation: detect the blocked-userns case and fall back to rootful\nif ! unshare --user --map-root-user true 2>/dev/null; then\n  exec sudo podman \"$@\"   # host policy forbids unprivileged userns\nfi\nexec podman \"$@\"","preventionTips":["Smoke-test `unshare --user --map-root-user true` on every new host/image before relying on rootless podman","Enable and persist user.max_user_namespaces (and kernel.unprivileged_userns_clone where it exists)","For podman-in-container, provision the outer container for userns (rootless podman-in-podman or appropriate privileges) instead of hitting clone at runtime","On Ubuntu 23.10+, install the distro podman package so its AppArmor profile authorizes userns"],"tags":["podman","rootless","userns","clone","sysctl","permissions"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}