podman-container-tools/podman · critical

cannot retrieve cmd line

Error message

cannot retrieve cmd line

What it means

The C-preamble constructor reads its own command line via get_cmd_line_args(), which opens and reads /proc/self/cmdline and splits it into argv (pkg/rootless/rootless_linux.c:538-602, called at 780). This message means the function returned NULL - the open/read of /proc/self/cmdline failed, an allocation failed, or the buffer contained no arguments - and the process _exits before the Go runtime starts. (Note: the message has no trailing newline, so it may concatenate with subsequent shell output.)

Source

Thrown at pkg/rootless/rootless_linux.c:782

                _exit (EXIT_FAILURE);

              for (i = size; i < new_size; i++)
                FD_ZERO (&(open_files_set[i]));

              size = new_size;
            }

          if (fd > open_files_max_fd)
            open_files_max_fd = fd;

          FD_SET (fd % FD_SETSIZE, &(open_files_set[fd / FD_SETSIZE]));
        }
    }

  argv = get_cmd_line_args (&argc);
  if (argv == NULL)
    {
      fprintf(stderr, "cannot retrieve cmd line");
      _exit (EXIT_FAILURE);
    }
  // Even if unused, this is needed to ensure we properly free the memory
  argv0 = argv[0];

  if (geteuid () != 0 || getenv ("_CONTAINERS_USERNS_CONFIGURED") == NULL)
    do_preexec_hooks(argv, argc);

  listen_pid = getenv("LISTEN_PID");
  listen_fds = getenv("LISTEN_FDS");
  listen_fdnames = getenv("LISTEN_FDNAMES");

  if (listen_pid != NULL && listen_fds != NULL && strtol(listen_pid, NULL, 10) == getpid())
    {
      // save systemd socket environment for rootless child
      do_socket_activation = true;
      saved_systemd_listen_pid = strdup(listen_pid);
      saved_systemd_listen_fds = strdup(listen_fds);

View on GitHub (pinned to a2409076ef)

Solutions

1. Ensure procfs is available: 'mount -t proc proc /proc' inside the namespace/chroot, then re-run
2. Check readability directly: 'cat /proc/self/cmdline' should succeed in the same environment
3. Relax the seccomp/LSM profile of the enclosing sandbox so /proc/self/cmdline is readable
4. Check memory limits ('ulimit -v') and raise them if the failure is allocation-related

Example fix

# before (inside a minimal chroot without /proc)
$ podman version
cannot retrieve cmd line

# after
$ mount -t proc proc /proc
$ podman version

# The C helper reads /proc/self/cmdline; probe the same file first
if [ ! -r /proc/self/cmdline ]; then
  echo "/proc is not available; podman cannot start here" >&2
  mount -t proc proc /proc 2>/dev/null || exit 1
fi
podman "$@"

When it happens

Trigger: Running the podman binary in an environment without procfs mounted or with /proc masked (minimal chroots, some sandboxes); an LSM or seccomp policy denying open/read of /proc/self/cmdline; ENOMEM during the 512-byte-increment buffer growth; a kernel returning an error on the read.

Common situations: Executing podman inside a minimal container/chroot where /proc was never mounted or was unmounted; gVisor or other runtimes with /proc quirks; hard seccomp profiles from a nesting orchestrator; severe memory pressure.

Related errors

• malloc: %m
• save socket listen environments error: %m
• error getting current working directory: %m
• invalid value for XDG_RUNTIME_DIR: %m
• unable to print to string

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/c80590cf31f14e9d. Report an issue: GitHub.