containerd/containerd · error

UID mapping: %w

Error message

UID mapping: %w

What it means

parseUsernsIDs orchestrates parsing of the pod's UID mappings and wraps any parseUsernsIDMap failure with the 'UID mapping:' prefix so the caller knows which mapping half failed. It is a pure error-passthrough wrapper: the underlying problem is always an invalid UID mapping list (too many lines or bad length).

Source

Thrown at internal/cri/server/podsandbox/helpers_linux.go:353

			HostID:      uidMap.HostId,
			Size:        uidMap.Length,
		},
	}

	return m, nil
}

func parseUsernsIDs(userns *runtime.UserNamespace) (uids, gids []runtimespec.LinuxIDMapping, retErr error) {
	if userns == nil {
		// If userns is not set, the kubelet doesn't support this option
		// and we should just fallback to no userns. This is completely
		// valid.
		return nil, nil, nil
	}

	uids, err := parseUsernsIDMap(userns.GetUids())
	if err != nil {
		return nil, nil, fmt.Errorf("UID mapping: %w", err)
	}

	gids, err = parseUsernsIDMap(userns.GetGids())
	if err != nil {
		return nil, nil, fmt.Errorf("GID mapping: %w", err)
	}

	switch mode := userns.GetMode(); mode {
	case runtime.NamespaceMode_NODE:
		if len(uids) != 0 || len(gids) != 0 {
			return nil, nil, fmt.Errorf("can't use user namespace mode %q with mappings. Got %v UID mappings and %v GID mappings", mode, len(uids), len(gids))
		}
	case runtime.NamespaceMode_POD:
		// This is valid, we will handle it in WithPodNamespaces().
		if len(uids) == 0 || len(gids) == 0 {
			return nil, nil, fmt.Errorf("can't use user namespace mode %q without UID and GID mappings", mode)
		}
	default:

View on GitHub (pinned to 4246446a2b)

Solutions

1. Fix the UID mapping list to contain exactly one entry with Length >= 1 (see errors 1203/1204).
2. If GIDs are fine and only UIDs are wrong, compare against the working GID config and mirror its shape.
3. Remove runAsUser-related userns config if userns support is not needed.

Example fix

// before
securityContext:
  sysctls: []
  # userns uids: two lines
// after
# single uid line: {containerId:0, hostId:65536, length:65536}

if u := userns.GetUids(); len(u) > 0 && (len(u) > 1 || u[0].GetLength() < 1) {
	return fmt.Errorf("rejecting pod: bad UID mapping config")
}

func uidMappingsOK(ns *runtime.UserNamespace) bool {
	u := ns.GetUids()
	return len(u) == 0 || (len(u) == 1 && u[0].GetLength() >= 1)
}

uids, gids, err := parseUsernsIDs(userns)
if err != nil && strings.HasPrefix(err.Error(), "UID mapping:") {
	return fmt.Errorf("pod userns UID config invalid: %w", err)
}

When it happens

Trigger: RunPodSandbox spec generation calls sandboxContainerSpec/snapshotterRemapOpts, which call parseUsernsIDs; the userns.GetUids() list fails validation inside parseUsernsIDMap (>1 lines or length < 1).

Common situations: Same root causes as the underlying parse errors: multi-line subuid configs or an omitted mapping length in the pod's user-namespace securityContext.

Related errors

• only one mapping line supported, got %v mapping lines
• invalid mapping length: %v
• GID mapping: %w
• can't use user namespace mode %q with mappings. Got %v UID m
• can't use user namespace mode %q without UID and GID mapping

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/db85636ff3e19ba6. Report an issue: GitHub.