{"record":{"id":"b18048ad6d2195d1","repo":"podman-container-tools/podman","slug":"cannot-set-s-namespace","errorCode":null,"errorMessage":"cannot set %s namespace\n","messagePattern":"cannot set (.+?) namespace\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/rootless/rootless_linux.c","lineNumber":179,"sourceCode":"  if (name_to_handle_at (mnt_fd, \"\", (struct file_handle *) &handles->mntns, &mount_id, AT_EMPTY_PATH) < 0)\n    return -1;\n\n  user_fd = open (\"/proc/self/ns/user\", O_RDONLY | O_CLOEXEC);\n  if (user_fd < 0)\n    return -1;\n\n  if (name_to_handle_at (user_fd, \"\", (struct file_handle *) &handles->userns, &mount_id, AT_EMPTY_PATH) < 0)\n    return -1;\n\n  return 0;\n}\n\nstatic void\njoin_namespace_or_die (const char *name, int ns_fd)\n{\n  if (setns (ns_fd, 0) < 0)\n    {\n      fprintf (stderr, \"cannot set %s namespace\\n\", name);\n      _exit (EXIT_FAILURE);\n    }\n}\n\nstatic int\nset_ns_handles (const char *path)\n{\n  cleanup_close int fd = -1;\n  struct ns_handles handles;\n  ssize_t bytes_read;\n  cleanup_close int userns_fd = -1;\n  cleanup_close int mntns_fd = -1;\n\n  fd = open (path, O_RDONLY | O_CLOEXEC);\n  if (fd < 0)\n    return -1;\n\n  bytes_read = TEMP_FAILURE_RETRY (read (fd, &handles, sizeof (handles)));","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L161-L197","documentation":"join_namespace_or_die() in podman's rootless C bootstrap calls setns(ns_fd, 0) to re-enter a saved user or mount namespace and _exit(EXIT_FAILURE) when it fails — the message names which namespace ('user' or 'mnt'). Call sites: set_ns_handles() re-entering saved ns handles (podman rootless resume path, after a successful setns into the saved userns it must also join the mnt ns or die), reexec_userns_join() joining another rootless podman's namespaces, and the reexec continuation around line 912. Typical errno: EPERM/EINVAL (fd not a namespace or lacking capability over it), or EBADF/EStale when the target process died and its /proc/*/ns fd went away.","triggerScenarios":"Rootless podman re-exec that must rejoin the original user+mount namespaces — e.g. joining an existing rootless podman instance or resuming after pause — when the owning process/session has died, the namespace fds were invalidated (reboot, session teardown), the caller lacks permission over the target userns, or an LSM/seccomp denies setns. The failure happens in C before Go code runs, so podman dies immediately with exit 1.","commonSituations":"systemd user session ended while podman state implied it could rejoin (no linger); stale files under ~/.local/share/containers/storage or the rootless state dir after a reboot; switching between rootful/rootless against the same DB; hardened kernels or SELinux restricting setns for the user.","solutions":["Start a fresh rootless podman instance rather than rejoining the dead one: remove the stale state (podman system reset for the rootless user, or clear ~/.local/share/containers) and rerun","Enable lingering for the rootless user so its user+mount namespaces survive logout: loginctl enable-linger USER","Confirm you run as the same user (never via sudo) that owns the rootless containers","Check for SELinux/AppArmor denials (ausearch -m avc) if namespaces are alive but setns still fails; update podman if the rejoin path is a known-fixed bug"],"exampleFix":"# before\nsudo podman ps   # mixing rootful sudo with rootless state tries bad namespace joins\n\n# after\nloginctl enable-linger $USER\npodman ps         # plain rootless, same user that owns the containers","handlingStrategy":"fallback","validationCode":"# Before resuming/joining rootless podman, check the owning session is alive\n#!/bin/sh\nuid=$(id -u)\nloginctl show-user \"$uid\" -p Linger 2>/dev/null | grep -q yes \\\n  || echo 'warning: linger off — rootless namespaces may vanish on logout' >&2\n# stale join handles after reboot/crash: probe cheaply, fall back to fresh state\nif ! podman info >/dev/null 2>&1; then\n  echo 'podman cannot rejoin its namespaces; consider resetting rootless state' >&2\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable linger for rootless service accounts: loginctl enable-linger USER — keeps user+mount namespaces alive across logouts","After a reboot or session crash, do not expect to rejoin old rootless namespaces; reset state (podman system reset as that user) and start fresh","Never mix sudo/rootful invocations with a user's rootless state; always run as the owning user"],"tags":["rootless","setns","namespaces","podman"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}