{"record":{"id":"f2c23bedbf838da1","repo":"podman-container-tools/podman","slug":"setns-newuser-m","errorCode":null,"errorMessage":"setns NEWUSER: %m","messagePattern":"setns NEWUSER: %m","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libpod/container_top_linux.c","lineNumber":88,"sourceCode":"      r = mount (\"proc\", \"/proc\", \"proc\", 0, NULL);\n      if (r < 0)\n        {\n          fprintf (stderr, \"mount proc: %m\");\n          exit (special_exit_code);\n        }\n      if (join_userns)\n        {\n          // join the userns to make sure uid mapping match\n          // we are already part of the pidns so so pid 1 is the main container process\n          r = open (\"/proc/1/ns/user\", O_CLOEXEC | O_RDONLY);\n          if (r < 0)\n            {\n              fprintf (stderr, \"open /proc/1/ns/user: %m\");\n              exit (special_exit_code);\n            }\n          if ((status = setns (r, CLONE_NEWUSER)) < 0)\n            {\n              fprintf (stderr, \"setns NEWUSER: %m\");\n              exit (special_exit_code);\n            }\n        }\n\n      /* use execve to unset all env vars, we do not want to leak anything into the container */\n      execve (argv[0], argv, NULL);\n      fprintf (stderr, \"execve: %m\");\n      exit (special_exit_code);\n    }\n\n  r = waitpid (pid, &status, 0);\n  if (r < 0)\n    {\n      fprintf (stderr, \"waitpid: %m\");\n      exit (special_exit_code);\n    }\n  if (WIFEXITED (status))\n    exit (WEXITSTATUS (status));","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/podman-container-tools/podman/blob/a2409076ef2fef60ad9ac046375dedc7d9410ef4/libpod/container_top_linux.c#L70-L106","documentation":"After successfully opening /proc/1/ns/user, the fork_exec_ps() child calls setns(fd, CLONE_NEWUSER) to enter the container's user namespace so UID mappings match ps output; failure prints 'setns NEWUSER: %m' and exits 255. Typical errno is EPERM: the caller must be privileged (CAP_SYS_ADMIN) over the target user namespace or share it — and podmanTopInner deliberately sets PR_SET_DUMPABLE=0 and PR_SET_NO_NEW_PRIVS, which makes an unprivileged setns(CLONE_NEWUSER) deny by design (kernel requires dumpable or CAP_SYS_ADMIN). EINVAL/EUSERS occur when mappings are malformed or the ns is not a user namespace.","triggerScenarios":"'podman top' on a container whose user namespace is not the caller's own: rootful podman top on a --userns=auto/keep-id container from a process that lost CAP_SYS_ADMIN over that ns; rootless top where the helper reexec'ed outside the container's userns; nesting levels that drop capabilities; seccomp filtering the setns syscall.","commonSituations":"Rootless containers with --userns=auto or --userns=keep-id on older podman releases (top/userns joining was fixed over time); podman executed under sudo inside a different userns; capability-dropping wrappers (systemd services with NoNewPrivileges, capsh --drop); custom seccomp profiles denying setns.","solutions":["Update podman to a current release — top's userns joining has seen multiple fixes","Run 'podman top' as the same user (and userns) that owns the container; for rootful, ensure the process keeps CAP_SYS_ADMIN (not dropped by wrapper/service)","Avoid --userns=auto/keep-id for containers you need to 'top', or run top rootful on rootless containers is not supported — use rootless top for rootless containers","Check seccomp/LSM is not denying setns for the podman process context"],"exampleFix":"# before\nsudo podman top myrootlessctr   # helper cannot setns into the container's userns\n\n# after\npodman top myrootlessctr          # same user/namespace as the container owner","handlingStrategy":"validation","validationCode":"# Run top as the owner of the container's user namespace\n#!/bin/sh\nowner=$(podman inspect -f '{{.State.Owner}}' \"$ctr\" 2>/dev/null) # rootless builds set this\nmyuid=$(id -u)\nctruid=$(podman inspect -f '{{.State.Pid}}' \"$ctr\" >/dev/null 2>&1 && \\\n  stat -c %u \"/proc/$(podman inspect -f '{{.State.Pid}}' \"$ctr\")/ns/user\" 2>/dev/null)\n[ -z \"$ctruid\" ] || [ \"$ctruid\" = \"$myuid\" ] \\\n  || echo \"warning: container userns owned by uid $ctruid, you are $myuid — top may fail setns\" >&2\npodman top \"$ctr\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Match invoker and container owner: rootless top for rootless containers, rootful top for rootful containers; never sudo into a rootless container's namespaces","Prefer a current podman release — top's userns joining has been fixed repeatedly","Avoid capability-dropping wrappers (NoNewPrivleases=true, capsh --drop=cap_sys_admin, strict seccomp) around the podman process"],"tags":["podman-top","userns","setns","capabilities"],"backgroundTag":null,"analyzedSha":"a2409076ef2fef60ad9ac046375dedc7d9410ef4","analyzedAt":"2026-08-15T15:57:05.625Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}