{"record":{"id":"db85636ff3e19ba6","repo":"containerd/containerd","slug":"uid-mapping-w-db8563","errorCode":null,"errorMessage":"UID mapping: %w","messagePattern":"UID mapping: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/podsandbox/helpers_linux.go","lineNumber":353,"sourceCode":"\t\t\tHostID:      uidMap.HostId,\n\t\t\tSize:        uidMap.Length,\n\t\t},\n\t}\n\n\treturn m, nil\n}\n\nfunc parseUsernsIDs(userns *runtime.UserNamespace) (uids, gids []runtimespec.LinuxIDMapping, retErr error) {\n\tif userns == nil {\n\t\t// If userns is not set, the kubelet doesn't support this option\n\t\t// and we should just fallback to no userns. This is completely\n\t\t// valid.\n\t\treturn nil, nil, nil\n\t}\n\n\tuids, err := parseUsernsIDMap(userns.GetUids())\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"UID mapping: %w\", err)\n\t}\n\n\tgids, err = parseUsernsIDMap(userns.GetGids())\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"GID mapping: %w\", err)\n\t}\n\n\tswitch mode := userns.GetMode(); mode {\n\tcase runtime.NamespaceMode_NODE:\n\t\tif len(uids) != 0 || len(gids) != 0 {\n\t\t\treturn nil, nil, fmt.Errorf(\"can't use user namespace mode %q with mappings. Got %v UID mappings and %v GID mappings\", mode, len(uids), len(gids))\n\t\t}\n\tcase runtime.NamespaceMode_POD:\n\t\t// This is valid, we will handle it in WithPodNamespaces().\n\t\tif len(uids) == 0 || len(gids) == 0 {\n\t\t\treturn nil, nil, fmt.Errorf(\"can't use user namespace mode %q without UID and GID mappings\", mode)\n\t\t}\n\tdefault:","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/podsandbox/helpers_linux.go#L335-L371","documentation":"parseUsernsIDs orchestrates parsing of the pod's UID mappings and wraps any parseUsernsIDMap failure with the 'UID mapping:' prefix so the caller knows which mapping half failed. It is a pure error-passthrough wrapper: the underlying problem is always an invalid UID mapping list (too many lines or bad length).","triggerScenarios":"RunPodSandbox spec generation calls sandboxContainerSpec/snapshotterRemapOpts, which call parseUsernsIDs; the userns.GetUids() list fails validation inside parseUsernsIDMap (>1 lines or length < 1).","commonSituations":"Same root causes as the underlying parse errors: multi-line subuid configs or an omitted mapping length in the pod's user-namespace securityContext.","solutions":["Fix the UID mapping list to contain exactly one entry with Length >= 1 (see errors 1203/1204).","If GIDs are fine and only UIDs are wrong, compare against the working GID config and mirror its shape.","Remove runAsUser-related userns config if userns support is not needed."],"exampleFix":"// before\nsecurityContext:\n  sysctls: []\n  # userns uids: two lines\n// after\n# single uid line: {containerId:0, hostId:65536, length:65536}","handlingStrategy":"validation","validationCode":"if u := userns.GetUids(); len(u) > 0 && (len(u) > 1 || u[0].GetLength() < 1) {\n\treturn fmt.Errorf(\"rejecting pod: bad UID mapping config\")\n}","typeGuard":"func uidMappingsOK(ns *runtime.UserNamespace) bool {\n\tu := ns.GetUids()\n\treturn len(u) == 0 || (len(u) == 1 && u[0].GetLength() >= 1)\n}","tryCatchPattern":"uids, gids, err := parseUsernsIDs(userns)\nif err != nil && strings.HasPrefix(err.Error(), \"UID mapping:\") {\n\treturn fmt.Errorf(\"pod userns UID config invalid: %w\", err)\n}","preventionTips":["Validate both UID and GID mapping lists before submitting the pod.","Keep UID/GID configs symmetrical to avoid half-valid configurations.","Unit-test pod templates with the exact mapping structs they will emit.","Log the full userns config when this wrapper error surfaces so the cause is obvious."],"tags":["userns","id-mapping","validation","cri"],"backgroundTag":"invalid-uid-mapping","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}