{"record":{"id":"6b484b8c8ef94f64","repo":"podman-container-tools/podman","slug":"user-namespaces-are-not-enabled-in-s","errorCode":null,"errorMessage":"user namespaces are not enabled in %s\n","messagePattern":"user namespaces are not enabled in (.+?)\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/rootless/rootless_linux.c","lineNumber":1279,"sourceCode":"  fprintf (stderr, \"failed to reexec: %m\\n\");\n\n  _exit (EXIT_FAILURE);\n}\n\nstatic void\ncheck_proc_sys_userns_file (const char *path)\n{\n  FILE *fp;\n  fp = fopen (path, \"r\");\n  if (fp)\n    {\n      char buf[32];\n      size_t n_read = fread (buf, 1, sizeof(buf) - 1, fp);\n      if (n_read > 0)\n        {\n          buf[n_read] = '\\0';\n          if (strtol (buf, NULL, 10) == 0)\n            fprintf (stderr, \"user namespaces are not enabled in %s\\n\", path);\n        }\n      fclose (fp);\n    }\n}\n\nint\nreexec_in_user_namespace (int ready, char *state_dir)\n{\n  cleanup_free char **argv = NULL;\n  cleanup_free char *argv0 = NULL;\n  cleanup_free char *cwd = NULL;\n  sigset_t sigset, oldsigset;\n  int ret;\n  pid_t pid;\n  char b;\n  char uid[16];\n  char gid[16];\n","sourceCodeStart":1261,"sourceCodeEnd":1297,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L1261-L1297","documentation":"Printed by check_proc_sys_userns_file after syscall_clone(CLONE_NEWUSER|CLONE_NEWNS) already failed in reexec_in_user_namespace (see error 58): podman reads /proc/sys/user/max_user_namespaces or /proc/sys/kernel/unprivileged_userns_clone, and if the value parses to 0 it prints this hint naming the offending sysctl path. It is diagnostic only — no exit, no extra failure — but it identifies the root cause: unprivileged user namespaces are administratively disabled.","triggerScenarios":"clone() failed (any errno, usually EPERM) AND user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0; i.e. any rootless podman startup on a host where the admin or distro disabled unprivileged userns.","commonSituations":"Hardened enterprise hosts (RHEL-style defaults); older Debian with kernel.unprivileged_userns_clone=0; locked-down CI images; embedded/appliance systems.","solutions":["Enable user namespaces: sudo sysctl -w user.max_user_namespaces=28633 (any non-zero value) and persist in /etc/sysctl.d/","On Debian: sudo sysctl -w kernel.unprivileged_userns_clone=1","If you cannot change host policy, run rootful podman (sudo podman ...)","Confirm the fix with: sysctl user.max_user_namespaces kernel.unprivileged_userns_clone and unshare --user --map-root-user true"],"exampleFix":"# before\n$ sysctl user.max_user_namespaces\nuser.max_user_namespaces = 0\npodman info  # -> user namespaces are not enabled in /proc/sys/user/max_user_namespaces\n\n# after\n# sysctl -w user.max_user_namespaces=28633\n# echo 'user.max_user_namespaces = 28633' >> /etc/sysctl.d/99-userns.conf\npodman info  # works","handlingStrategy":"validation","validationCode":"sysctl -n user.max_user_namespaces | grep -q '^0$' && echo \"userns disabled: user.max_user_namespaces=0\"\n[ -r /proc/sys/kernel/unprivileged_userns_clone ] && sysctl -n kernel.unprivileged_userns_clone | grep -q '^0$' && echo \"userns disabled: unprivileged_userns_clone=0\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-check both sysctls (and run unshare --user --map-root-user true) before deploying rootless podman on a host","Persist non-zero values in /etc/sysctl.d/ so reboots keep userns enabled","On locked-down hosts, plan for rootful podman (sudo) as the supported mode"],"tags":["podman","rootless","userns","sysctl","diagnostics"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}