{"record":{"id":"4057f9352d672f1f","repo":"containerd/containerd","slug":"failed-to-do-idmap-to-get-host-id-w","errorCode":null,"errorMessage":"failed to do idmap to get host ID: %w","messagePattern":"failed to do idmap to get host ID: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/container_start_linux.go","lineNumber":68,"sourceCode":"\tspec, err := cntr.Spec(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get spec: %w\", err)\n\t}\n\n\tif spec.Linux == nil || spec.Process == nil {\n\t\treturn nil, fmt.Errorf(\"invalid linux platform oci runtime spec\")\n\t}\n\n\tidMap := userns.IDMap{\n\t\tUidMap: spec.Linux.UIDMappings,\n\t\tGidMap: spec.Linux.GIDMappings,\n\t}\n\thostID, err := idMap.ToHost(userns.User{\n\t\tUid: spec.Process.User.UID,\n\t\tGid: spec.Process.User.GID,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to do idmap to get host ID: %w\", err)\n\t}\n\n\treturn []containerd.NewTaskOpts{\n\t\tcontainerd.WithUIDOwner(hostID.Uid),\n\t\tcontainerd.WithGIDOwner(hostID.Gid),\n\t}, nil\n}\n","sourceCodeStart":50,"sourceCodeEnd":76,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/container_start_linux.go#L50-L76","documentation":"With a valid spec and idmap, updateContainerIOOwner maps the container-namespace UID/GID (from spec.Process.User) to host IDs using userns.IDMap.ToHost. If the mapping cannot be performed (e.g. the container user has no corresponding host ID in the configured UID/GID mappings), this wrapped error is returned and the task is not started.","triggerScenarios":"Starting a user-namespaced container whose spec.Process.User.UID/GID falls outside the ranges covered by spec.Linux.UIDMappings/GIDMappings, or when the mapping tables are empty/invalid.","commonSituations":"Container image or securityContext sets a UID (e.g. 100000) outside the pod's userns mapping range; kubelet userns range configuration doesn't cover the image's user; missing /etc/subuid//etc/subgid entries.","solutions":["Compare the container's UID/GID against the pod's UID/GID mappings and align them (adjust securityContext runAsUser or the mapping range)","Ensure /etc/subuid and /etc/subgid on the node cover the ranges assigned to user namespaces","Use runAsUser: 0 inside the userns container (mapped to an unprivileged host user)","Verify the userns range allocated by kubelet (user-namespaces feature) is large enough"],"exampleFix":"// before: image requires UID 100000 but pod userns range is 0-65535\n// after: adjust securityContext to fit within the mapped range\nspec:\n  containers:\n  - name: app\n    securityContext:\n      runAsUser: 1000   # inside the pod's userns mapping range\n      runAsGroup: 1000","handlingStrategy":"validation","validationCode":"uid := securityContext.RunAsUser\ngid := securityContext.RunAsGroup\nif uid >= podUsernsRange.Size || gid >= podUsernsRange.Size {\n    return fmt.Errorf(\"UID/GID %d/%d outside userns range size %d\", uid, gid, podUsernsRange.Size)\n}","typeGuard":null,"tryCatchPattern":"if err := startContainer(id); err != nil {\n    if strings.Contains(err.Error(), \"failed to do idmap to get host ID\") {\n        // fix securityContext runAsUser/runAsGroup or /etc/subuid, /etc/subgid\n    }\n    return err\n}","preventionTips":["Keep container runAsUser/runAsGroup within the pod's userns mapping size","Maintain adequate /etc/subuid and /etc/subgid ranges on the node","Prefer runAsUser: 0 inside userns containers (auto-mapped to unprivileged host user)"],"tags":["user-namespaces","id-mapping","linux","cri"],"backgroundTag":"userns-id-mapping-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}