{"record":{"id":"68438c586bede757","repo":"podman-container-tools/podman","slug":"cannot-setresuid-m","errorCode":null,"errorMessage":"cannot setresuid: %m\n","messagePattern":"cannot setresuid: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":932,"sourceCode":"joined:\n      sprintf (uid_fmt, \"%d\", uid);\n      sprintf (gid_fmt, \"%d\", gid);\n\n      setenv (\"_CONTAINERS_USERNS_CONFIGURED\", \"init\", 1);\n      setenv (\"_CONTAINERS_ROOTLESS_UID\", uid_fmt, 1);\n      setenv (\"_CONTAINERS_ROOTLESS_GID\", gid_fmt, 1);\n\n      /* We are in the user+mount namespace, these errors are not recoverable.  */\n\n      if (syscall_setresgid (0, 0, 0) < 0)\n        {\n          fprintf (stderr, \"cannot setresgid: %m\\n\");\n          _exit (EXIT_FAILURE);\n        }\n\n      if (syscall_setresuid (0, 0, 0) < 0)\n        {\n          fprintf (stderr, \"cannot setresuid: %m\\n\");\n          _exit (EXIT_FAILURE);\n        }\n\n      if (chdir (cwd) < 0)\n        {\n          fprintf (stderr, \"cannot chdir to %s: %m\\n\", cwd);\n          _exit (EXIT_FAILURE);\n        }\n\n      rootless_uid_init = uid;\n      rootless_gid_init = gid;\n    }\n}\n\nstatic int\nsyscall_clone (unsigned long flags, void *child_stack)\n{\n#if defined(__s390__) || defined(__CRIS__)","sourceCodeStart":914,"sourceCodeEnd":950,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L914-L950","documentation":"Companion to setresgid: after joining the existing user+mount namespaces on the shortcut path, the preamble calls setresuid(0,0,0) to become uid 0 inside the user namespace (pkg/rootless/rootless_linux.c:930-935). The source marks this as unrecoverable - failure _exits the process before Go starts. Typical errno is EPERM: seccomp denying setresuid, missing CAP_SETUID, or a UID map without 0 mapped.","triggerScenarios":"Same class as error 35: rootless podman nested in a container blocking set*id syscalls; restrictive seccomp/AppArmor policy on the podman process; user namespace mappings that do not include UID 0 for the joined ns.","commonSituations":"Docker default seccomp profile applied to an inner podman; hardened CI runners; custom LSM policies; following the setresgid failure once GID succeeded but UID policy blocks the call.","solutions":["For podman-in-container, apply the documented flags: '--security-opt seccomp=unconfined' and ensure the outer runtime grants the needed capabilities or is itself rootless","Confirm basic userns functionality: 'unshare -Ur id' should show uid=0","Review seccomp/AppArmor denials in 'journalctl -k' or 'dmesg' for setresuid","Collect an strace of the failing call and report upstream with the environment description"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Same probe guards both setresgid and setresuid transitions\nunshare -Ur sh -c 'id -u | grep -qx 0' || { echo \"cannot become uid 0 in a user namespace here\" >&2; exit 1; }\npodman \"$@\"\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Apply container-nesting security options before running inner podman","Check kernel logs for seccomp/AppArmor setresuid denials when this appears","Keep outer and inner podman versions aligned with the documented nesting guidance"],"tags":["userns","seccomp","rootless","permissions","container-nesting"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}