{"record":{"id":"e44c0b4cf83d2520","repo":"podman-container-tools/podman","slug":"open-proc-1-ns-user-m","errorCode":null,"errorMessage":"open /proc/1/ns/user: %m","messagePattern":"open /proc/1/ns/user: %m","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libpod/container_top_linux.c","lineNumber":83,"sourceCode":"      fprintf (stderr, \"fork: %m\");\n      exit (special_exit_code);\n    }\n  if (pid == 0)\n    {\n      r = mount (\"proc\", \"/proc\", \"proc\", 0, NULL);\n      if (r < 0)\n        {\n          fprintf (stderr, \"mount proc: %m\");\n          exit (special_exit_code);\n        }\n      if (join_userns)\n        {\n          // join the userns to make sure uid mapping match\n          // we are already part of the pidns so so pid 1 is the main container process\n          r = open (\"/proc/1/ns/user\", O_CLOEXEC | O_RDONLY);\n          if (r < 0)\n            {\n              fprintf (stderr, \"open /proc/1/ns/user: %m\");\n              exit (special_exit_code);\n            }\n          if ((status = setns (r, CLONE_NEWUSER)) < 0)\n            {\n              fprintf (stderr, \"setns NEWUSER: %m\");\n              exit (special_exit_code);\n            }\n        }\n\n      /* use execve to unset all env vars, we do not want to leak anything into the container */\n      execve (argv[0], argv, NULL);\n      fprintf (stderr, \"execve: %m\");\n      exit (special_exit_code);\n    }\n\n  r = waitpid (pid, &status, 0);\n  if (r < 0)\n    {","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/libpod/container_top_linux.c#L65-L101","documentation":"With join_userns set (container has its own user namespace, e.g. rootless containers or --userns), the fork_exec_ps() child tries open(\"/proc/1/ns/user\") after entering the container's PID namespace: PID 1 is the container's init, and its ns/user file identifies the container's user namespace to join. %m is strerror(errno): ENOENT/ESRCH when there is no such PID (container init exited), EACCES when procfs is mounted with hidepid or ptrace_scope/Yama blocks access to other processes' ns files.","triggerScenarios":"'podman top' on a userns container whose init has just exited or is dying (racing 'podman stop'); hidepid=2 on the host /proc; a Yama ptrace_scope setting denying access to /proc/1 of the new pidns for the unprivileged helper; top run exactly as the container transitions states.","commonSituations":"Scripts running 'podman top' in a poll loop that races container shutdown; hardened hosts mounting /proc with hidepid; monitoring agents sampling dying containers; rootless sessions after the session's user namespace was torn down.","solutions":["Confirm the container is actually running before sampling: podman inspect -f '{{.State.Status}}' CTOR","Retry once — a dying init makes this a race; if it persists on a running container, continue below","On hosts using hidepid, mount /proc without hidepid or exempt the podman user (prochidepid group on some distros)","Adjust kernel.yama.ptrace_scope or run the top as the container's owner/root if access to /proc/1/ns is denied"],"exampleFix":"# before\nwhile true; do podman top web >/tmp/top.log; sleep 1; done\n\n# after (only sample live containers)\nwhile true; do [ \"$(podman inspect -f '{{.State.Status}}' web)\" = running ] && podman top web >/tmp/top.log; sleep 1; done","handlingStrategy":"validation","validationCode":"# Only sample live containers; avoids racing a dying container init\n#!/bin/sh\nfor ctr in \"$@\"; do\n  st=$(podman inspect -f '{{.State.Status}}' \"$ctr\" 2>/dev/null) || continue\n  [ \"$st\" = running ] || { echo \"skip $ctr (state: $st)\" >&2; continue; }\n  podman top \"$ctr\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Gate 'podman top' on State.Status == running — a dying PID 1 makes /proc/1/ns/user vanish","Avoid hidepid on host /proc mounts, or exempt the podman user from hidepid restrictions","In poll loops, tolerate single-sample failures (race with shutdown) instead of alerting on them"],"tags":["podman-top","userns","procfs"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}