podman-container-tools/podman · error

cannot prctl(PR_SET_PDEATHSIG): %m

Error message

cannot prctl(PR_SET_PDEATHSIG): %m

What it means

In the reexec_userns_join child, prctl(PR_SET_PDEATHSIG, SIGTERM, 0, 0, 0) failed and the child _exit(EXIT_FAILURE)s before joining the target namespaces. PDEATHSIG makes the joiner die with its parent so no orphan holds the namespace. On Linux this prctl fails with EINVAL only for a bad signal — so a real-world failure almost always means a seccomp filter or LSM denied prctl (EPERM).

Source

Thrown at pkg/rootless/rootless_linux.c:1210

  if (do_socket_activation)
    {
      char s[32];
      sprintf (s, "%d", getpid());
      setenv ("LISTEN_PID", s, true);
      setenv ("LISTEN_FDS", saved_systemd_listen_fds, true);
      // Setting fdnames is optional for systemd_socket_activation
      if (saved_systemd_listen_fdnames != NULL)
        setenv ("LISTEN_FDNAMES", saved_systemd_listen_fdnames, true);
    }

  setenv ("_CONTAINERS_USERNS_CONFIGURED", "done", 1);
  setenv ("_CONTAINERS_ROOTLESS_UID", uid, 1);
  setenv ("_CONTAINERS_ROOTLESS_GID", gid, 1);

  if (prctl (PR_SET_PDEATHSIG, SIGTERM, 0, 0, 0) < 0)
    {
      fprintf (stderr, "cannot prctl(PR_SET_PDEATHSIG): %m\n");
      _exit (EXIT_FAILURE);
    }

  join_namespace_or_die ("user", userns_fd);
  join_namespace_or_die ("mnt", mntns_fd);

  if (syscall_setresgid (0, 0, 0) < 0)
    {
      fprintf (stderr, "cannot setresgid: %m\n");
      _exit (EXIT_FAILURE);
    }

  if (syscall_setresuid (0, 0, 0) < 0)
    {
      fprintf (stderr, "cannot setresuid: %m\n");
      _exit (EXIT_FAILURE);
    }

View on GitHub (pinned to a2409076ef)

Solutions

1. Allow prctl(PR_SET_PDEATHSIG) in the governing seccomp profile / sandbox policy
2. Run the join outside the restricting sandbox (e.g. on the host) to confirm the diagnosis
3. File a policy exception with the sandbox/agent maintainer — podman requires this prctl for rootless joins

# verify prctl is allowed by the sandbox's seccomp policy
strace -e prctl -f unshare --user --map-root-user true 2>&1 | grep -i prctl || echo "prctl not observed/allowed?"

When it happens

Trigger: Running the rootless join path under a seccomp profile that blocks or errors prctl (restricted containers, custom sandboxes, some CI runners); LSM/AppArmor confinement denying prctl for the process.

Common situations: Podman nested inside a hardened container or agent sandbox whose default seccomp profile denies prctl; corporate endpoint-security LSMs injecting policy.

Related errors

• cannot block signals: %m
• cannot set %s namespace
• cannot retrieve cmd line
• error opening namespace handles: %m
• cannot setresgid: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/051eec2d0fbc64d5. Report an issue: GitHub.