{"record":{"id":"c971abc5a71092e9","repo":"podman-container-tools/podman","slug":"fork-m-c971ab","errorCode":null,"errorMessage":"fork: %m\n","messagePattern":"fork: %m\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/rootless/rootless_linux.c","lineNumber":375,"sourceCode":"  ret = save_ns_handles (ns_handles_path, &handles);\n  saved_errno = errno;\n  close (lock_fd);\n  lock_fd = -1;  /* Prevent cleanup from running.  */\n  errno = saved_errno;\n  return ret;\n}\n\n/* exec the specified executable and exit if it fails.  */\nstatic void\nexec_binary (const char *path, char **argv, int argc)\n{\n  int r, status = 0;\n  pid_t pid;\n\n  pid = fork ();\n  if (pid < 0)\n    {\n      fprintf (stderr, \"fork: %m\\n\");\n      exit (EXIT_FAILURE);\n    }\n  if (pid == 0)\n    {\n      size_t i;\n      char **newargv = malloc ((argc + 2) * sizeof(char *));\n      if (!newargv)\n        {\n          fprintf (stderr, \"malloc: %m\\n\");\n          exit (EXIT_FAILURE);\n        }\n      newargv[0] = (char*) path;\n      for (i = 0; i < argc; i++)\n        newargv[i+1] = argv[i];\n\n      newargv[i+1] = NULL;\n      errno = 0;\n      execv (path, newargv);","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/pkg/rootless/rootless_linux.c#L357-L393","documentation":"exec_binary() — used to run pre-exec hook binaries during podman's rootless re-exec — failed at fork() before it could exec the hook; %m is strerror(errno), almost always EAGAIN (RLIMIT_NPROC / cgroup pids.max / systemd TasksMax exhausted) or ENOMEM. Pre-exec hooks run only when /etc/containers/podman_preexec_hooks.txt exists, from LIBEXECPODMAN/pre-exec-hooks, ETC_PREEXEC_HOOKS, or $PODMAN_PREEXEC_HOOKS_DIR. The whole podman invocation exits with EXIT_FAILURE.","triggerScenarios":"Rootless podman re-exec with pre-exec hooks configured (indicator file /etc/containers/podman_preexec_hooks.txt present) while the user's process/thread budget is exhausted: ulimit -u hit, systemd user slice TasksMax reached, or cgroup pids.max full — fork() returns EAGAIN and podman aborts.","commonSituations":"Leaky workloads spawning threads until TasksMax; monitoring agents looping podman as a rootless user near nproc limits; systems where pids cgroup of the user session is shared and saturated; heavier-than-expected hook directories multiplying processes.","solutions":["Raise the limits for the rootless user: ulimit -u, systemd TasksMax (user slice), or the session pids.max","Kill leaked processes/zombies of that user to free slots, then retry the podman command","If hooks are not needed, remove /etc/containers/podman_preexec_hooks.txt or the hooks directories to skip the fork entirely","Verify current usage: ps -u USER -L | wc -l vs cat /sys/fs/cgroup/.../pids.max"],"exampleFix":"# before: user slice tasks exhausted\nsystemctl status user-1000.slice   # Tasks: 4911/4915\n\n# after\nsudo systemctl set-property user-1000.slice TasksMax=infinity\npodman ps","handlingStrategy":"retry","validationCode":"# EAGAIN at fork is the norm — verify process headroom before invoking podman\n#!/bin/sh\nuid=$(id -u)\nslice=\"/sys/fs/cgroup/user.slice/user-${uid}.slice\"\nmax=$(cat \"$slice/pids.max\" 2>/dev/null || echo max)\n[ \"$max\" = max ] || {\n  cur=$(cat \"$slice/pids.current\" 2>/dev/null || echo 0)\n  [ \"$cur\" -lt $((max - 10)) ] || { echo \"user slice pids nearly full: $cur/$max\" >&2; exit 1; }\n}\nexec podman \"$@\"","typeGuard":null,"tryCatchPattern":"#!/bin/sh\ni=0\nwhile ! podman \"$@\" 2>err.log; do\n  grep -q 'fork: Resource temporarily unavailable\\|fork: EAGAIN' err.log || { cat err.log >&2; exit 1; }\n  i=$((i+1)); [ $i -le 3 ] || { cat err.log >&2; exit 1; }\n  sleep 2\ndone","preventionTips":["Raise TasksMax for the rootless user slice (systemctl set-property user-UID.slice TasksMax=...) or the session pids.max","If pre-exec hooks are not used, remove /etc/containers/podman_preexec_hooks.txt — no indicator file means no hook forks at all","Keep an eye on thread-heavy workloads sharing the user slice; they can starve podman's re-exec of its single fork"],"tags":["rootless","fork","pre-exec-hooks","process-limits"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}