podman-container-tools/podman · critical

cannot clone: %m\n

Error message

cannot clone: %m\n

What it means

In reexec_in_user_namespace, syscall_clone(CLONE_NEWUSER|CLONE_NEWNS|SIGCHLD, NULL) — creating the user+mount namespace pair that the entire rootless podman model rests on — returned < 0. %m is usually 'Operation not permitted' (EPERM); the failure is immediately followed by the sysctl hint from error 56. This kills rootless startup before anything else happens; it is the canonical 'rootless podman cannot create user namespace' error.

Source

Thrown at pkg/rootless/rootless_linux.c:1311

  pid_t pid;
  char b;
  char uid[16];
  char gid[16];

  cwd = getcwd (NULL, 0);
  if (cwd == NULL)
    {
      fprintf (stderr, "error getting current working directory: %m\n");
      _exit (EXIT_FAILURE);
    }

  sprintf (uid, "%d", geteuid ());
  sprintf (gid, "%d", getegid ());

  pid = syscall_clone (CLONE_NEWUSER|CLONE_NEWNS|SIGCHLD, NULL);
  if (pid < 0)
    {
      fprintf (stderr, "cannot clone: %m\n");
      check_proc_sys_userns_file (_max_user_namespaces);
      check_proc_sys_userns_file (_unprivileged_user_namespaces);
    }
  if (pid)
    {
      if (do_socket_activation)
        {
          long num_fds;

          num_fds = strtol (saved_systemd_listen_fds, NULL, 10);
          if (num_fds != LONG_MIN && num_fds != LONG_MAX)
            {
              int f;

              for (f = 3; f < num_fds + 3; f++)
                if (is_fd_inherited (f))
                  close (f);
            }

View on GitHub (pinned to a2409076ef)

Solutions

1. Read the following hint line (error 56) and fix the named sysctl: sysctl -w user.max_user_namespaces=28633 and, where present, kernel.unprivileged_userns_clone=1
2. Verify quickly: unshare --user --map-root-user true — if that fails, the host (not podman) blocks userns
3. On Ubuntu 23.10+ with AppArmor restriction, use the distro podman package with its AppArmor profile or set kernel.apparmor_restrict_unprivileged_userns=0
4. Inside a container, run the outer container with privileges that permit userns (rootless podman-in-podman per docs, or --privileged) — or use sudo podman
5. If errno is EAGAIN, check /proc/sys/user/max_user_namespaces usage and process/pid limits, and clear leaked namespaces

Example fix

# before
$ podman info
cannot clone: Operation not permitted
user namespaces are not enabled in /proc/sys/user/max_user_namespaces

# after
# sysctl -w user.max_user_namespaces=28633
# echo 'user.max_user_namespaces = 28633' > /etc/sysctl.d/99-userns.conf
$ podman info   # succeeds

# host must permit unprivileged userns before rootless podman can work
sysctl user.max_user_namespaces kernel.unprivileged_userns_clone 2>/dev/null
unshare --user --map-root-user true && echo "userns OK" || echo "userns blocked (sysctl, seccomp or LSM)"

# in automation: detect the blocked-userns case and fall back to rootful
if ! unshare --user --map-root-user true 2>/dev/null; then
  exec sudo podman "$@"   # host policy forbids unprivileged userns
fi
exec podman "$@"

When it happens

Trigger: user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0; seccomp profiles or AppArmor (e.g. Ubuntu 23.10+ kernel.apparmor_restrict_unprivileged_userns=1) denying clone with CLONE_NEWUSER; running inside an unprivileged outer container/CI sandbox; EAGAIN/'Resource temporarily unavailable' when the per-user namespace count or pid limits are exhausted; nesting-depth limits.

Common situations: podman-in-docker without userns privileges; hardened enterprise hosts; gVisor/runsc sandboxes; freshly installed distros with restricted userns defaults; CI images with strict seccomp.

Related errors

• user namespaces are not enabled in %s
• cannot setresgid: %m
• cannot setresuid: %m
• cannot read argv: %m
• error getting current working directory: %m\n

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/16474743214cab37. Report an issue: GitHub.