{"record":{"id":"a66fabbdf13f4927","repo":"podman-container-tools/podman","slug":"mount-proc-m","errorCode":null,"errorMessage":"mount proc: %m","messagePattern":"mount proc: %m","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libpod/container_top_linux.c","lineNumber":73,"sourceCode":"\n  if (argv == NULL)\n    {\n      fprintf (stderr, \"argv not initialized\");\n      exit (special_exit_code);\n    }\n\n  pid = fork ();\n  if (pid < 0)\n    {\n      fprintf (stderr, \"fork: %m\");\n      exit (special_exit_code);\n    }\n  if (pid == 0)\n    {\n      r = mount (\"proc\", \"/proc\", \"proc\", 0, NULL);\n      if (r < 0)\n        {\n          fprintf (stderr, \"mount proc: %m\");\n          exit (special_exit_code);\n        }\n      if (join_userns)\n        {\n          // join the userns to make sure uid mapping match\n          // we are already part of the pidns so so pid 1 is the main container process\n          r = open (\"/proc/1/ns/user\", O_CLOEXEC | O_RDONLY);\n          if (r < 0)\n            {\n              fprintf (stderr, \"open /proc/1/ns/user: %m\");\n              exit (special_exit_code);\n            }\n          if ((status = setns (r, CLONE_NEWUSER)) < 0)\n            {\n              fprintf (stderr, \"setns NEWUSER: %m\");\n              exit (special_exit_code);\n            }\n        }","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/libpod/container_top_linux.c#L55-L91","documentation":"In the child of fork_exec_ps(), mount(\"proc\", \"/proc\", \"proc\", 0, NULL) failed before exec'ing ps. 'podman top' reexecs itself into a new mount+pid namespace (podmanTopInner) and the C child mounts a fresh procfs for the container's PID namespace; %m is strerror(errno), typically EPERM/EACCES (missing CAP_SYS_ADMIN, seccomp or LSM blocking mount(2)) or EINVAL on odd kernel configurations. Failure exits 255 (special_exit_code).","triggerScenarios":"'podman top' on a container when the reexec'ed helper lacks privilege to mount proc: rootless podman without a working user namespace, podman running under a restrictive seccomp/AppArmor/SELinux profile that denies mount, container-in-container (Docker-in-Podman) where inner podman top's mount is blocked, or hardened kernels (lockdown) refusing new procfs mounts.","commonSituations":"Running podman inside an unprivileged sandbox/CI container without CAP_SYS_ADMIN; custom seccomp profiles in /etc/containers/seccomp.json that block the mount syscall; rootless setups where newuidmap/newgidmap are missing so the userns bootstrap is incomplete; very old kernels.","solutions":["If podman itself runs inside a container/sandbox, give it the needed privilege (--privileged or cap_add SYS_ADMIN) or run podman on the host","Restore the default seccomp profile or add 'mount' to allowed syscalls for the podman process context","For rootless: verify newuidmap/newgidmap are installed and /etc/subuid, /etc/subgid have entries for the user","Update podman — top namespace handling has been hardened over releases; check 'podman info' and report with it if persistent"],"exampleFix":"# before (podman nested inside a locked-down CI container)\npodman top inner-ctr\n\n# after (run the inner engine with mount privileges)\npodman run --cap-add SYS_ADMIN quay.io/podman/stable podman top inner-ctr","handlingStrategy":"validation","validationCode":"# Can this context mount a fresh procfs? Verify before relying on podman top\n#!/bin/sh\nif podman info --format '{{.Host.Security.Rootless}}' | grep -q true; then\n  # rootless: userns bootstrap must work (newuidmap/newgidmap present)\n  command -v newuidmap >/dev/null && command -v newgidmap >/dev/null \\\n    || { echo 'rootless requires newuidmap/newgidmap' >&2; exit 1; }\n  grep -q \"^$USER:\" /etc/subuid 2>/dev/null \\\n    || { echo \"no /etc/subuid entry for $USER\" >&2; exit 1; }\nfi\n# quick capability probe for the mount(2) podman top needs\nunshare -m sh -c 'mount -t proc proc /proc' >/dev/null 2>&1 \\\n  || { echo 'this context cannot mount proc (missing CAP_SYS_ADMIN or seccomp)' >&2; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run podman on the host or in a container with --privileged/--cap-add SYS_ADMIN — nested unprivileged podman cannot mount proc for top","Keep the distro default /etc/containers/seccomp.json; if customized, make sure mount is allowed for the podman process context","Rootless: verify newuidmap/newgidmap and /etc/subuid,/etc/subgid entries (run 'podman system migrate' after changes)"],"tags":["podman-top","mount","proc","namespaces","capabilities"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}