{"record":{"id":"408500343e6257c9","repo":"podman-container-tools/podman","slug":"error-opening-namespace-handles-m","errorCode":null,"errorMessage":"error opening namespace handles: %m\n","messagePattern":"error opening namespace handles: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":865,"sourceCode":"        }\n\n      if (set_ns_handles (path) == 0)\n        goto joined;\n\n      /* If the handle is stale, give up with the shortcut.  */\n      if (errno == ESTALE)\n        return;\n\n      /* Fall back to pause.pid if:\n         - ENOENT ns_handles file doesn't exist\n         - EOPNOTSUPP kernel doesn't support open_by_handle_at\n         - ENOSYS syscall not available\n         - EPERM (could be seccomp when running in a container)\n       */\n      if (errno != ENOENT && errno != EOPNOTSUPP && errno != ENOSYS && errno != EPERM)\n        {\n          /* Anything else is fatal.  */\n          fprintf (stderr, \"error opening namespace handles: %m\\n\");\n          _exit (EXIT_FAILURE);\n        }\n\n      /* Fall back to pause.pid for compatibility with older versions or if the kernel is too old.  */\n      len = snprintf (path, PATH_MAX, \"%s/libpod/tmp/pause.pid\", xdg_runtime_dir);\n      if (len >= PATH_MAX)\n        {\n          errno = ENAMETOOLONG;\n          fprintf (stderr, \"invalid value for XDG_RUNTIME_DIR: %m\");\n          exit (EXIT_FAILURE);\n        }\n\n      fd = open (path, O_RDONLY);\n      if (fd < 0)\n        return;\n\n      r = TEMP_FAILURE_RETRY (read (fd, buf, sizeof (buf) - 1));\n      if (r < 0)","sourceCodeStart":847,"sourceCodeEnd":883,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L847-L883","documentation":"The shortcut path tries to reopen the cached namespace file descriptors stored under '$XDG_RUNTIME_DIR/libpod/tmp/ns_handles' via set_ns_handles() (name_to_handle_at/open_by_handle_at machinery). Known-recoverable errnos are handled: ESTALE returns to the re-exec path, and ENOENT/EOPNOTSUPP/ENOSYS/EPERM fall back to the pause.pid mechanism (pkg/rootless/rootless_linux.c:858-868). This fatal message means the error was none of those - e.g. EMFILE/ENFILE (fd exhaustion) or an unexpected LSM/seccomp errno - so the process _exits.","triggerScenarios":"The user session is at its RLIMIT_NOFILE ceiling when podman tries to open the namespace handles (EMFILE/ENFILE); an unusual security policy denies open_by_handle_at with an errno outside the whitelisted set; a kernel/filesystem combination returning an exotic error for the stored handle.","commonSituations":"Long-lived desktop sessions or IDEs that consume thousands of fds, then launch a rootless podman; podman nested inside custom sandboxes with nonstandard seccomp filters; very new or very old kernels after a podman upgrade introduced the ns_handles fast path.","solutions":["Check fd usage and limits: 'ulimit -n' and 'ls /proc/$$/fd | wc -l'; raise the limit ('ulimit -n 4096' or systemd DefaultLIMIT_NOFILE) and retry","Check the exact errno in the printed message and match it against the whitelisted set to identify an LSM/seccomp interposer","Close fd-heavy applications or log out/in to reset the session, then retry","Report upstream with the errno string, kernel version, and whether the ns_handles file exists in $XDG_RUNTIME_DIR/libpod/tmp"],"exampleFix":"# before\n$ ulimit -n\n1024\n$ podman ps   # error opening namespace handles: Too many open files\n\n# after\n$ ulimit -n 4096\n$ podman ps\n","handlingStrategy":"validation","validationCode":"# Ensure fd headroom for opening the namespace handles\nused=$(ls /proc/$$/fd 2>/dev/null | wc -l); max=$(ulimit -n)\nif [ \"$used\" -ge $((max - 64)) ]; then\n  ulimit -n \"$((max * 2))\" 2>/dev/null || echo \"raise RLIMIT_NOFILE before running podman\" >&2\nfi\npodman \"$@\"\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Raise RLIMIT_NOFILE (systemd DefaultLIMIT_NOFILE=...) on developer workstations and CI","Close fd-leaking applications or restart long sessions before running rootless podman","Document nonstandard seccomp/LSM policies that intercept open_by_handle_at with unusual errnos"],"tags":["rootless","namespace","file-handles","fd-limits","seccomp"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}