podman-container-tools/podman · critical

cannot set %s namespace

Error message

cannot set %s namespace

What it means

join_namespace_or_die() in podman's rootless C bootstrap calls setns(ns_fd, 0) to re-enter a saved user or mount namespace and _exit(EXIT_FAILURE) when it fails — the message names which namespace ('user' or 'mnt'). Call sites: set_ns_handles() re-entering saved ns handles (podman rootless resume path, after a successful setns into the saved userns it must also join the mnt ns or die), reexec_userns_join() joining another rootless podman's namespaces, and the reexec continuation around line 912. Typical errno: EPERM/EINVAL (fd not a namespace or lacking capability over it), or EBADF/EStale when the target process died and its /proc/*/ns fd went away.

Source

Thrown at pkg/rootless/rootless_linux.c:179

  if (name_to_handle_at (mnt_fd, "", (struct file_handle *) &handles->mntns, &mount_id, AT_EMPTY_PATH) < 0)
    return -1;

  user_fd = open ("/proc/self/ns/user", O_RDONLY | O_CLOEXEC);
  if (user_fd < 0)
    return -1;

  if (name_to_handle_at (user_fd, "", (struct file_handle *) &handles->userns, &mount_id, AT_EMPTY_PATH) < 0)
    return -1;

  return 0;
}

static void
join_namespace_or_die (const char *name, int ns_fd)
{
  if (setns (ns_fd, 0) < 0)
    {
      fprintf (stderr, "cannot set %s namespace\n", name);
      _exit (EXIT_FAILURE);
    }
}

static int
set_ns_handles (const char *path)
{
  cleanup_close int fd = -1;
  struct ns_handles handles;
  ssize_t bytes_read;
  cleanup_close int userns_fd = -1;
  cleanup_close int mntns_fd = -1;

  fd = open (path, O_RDONLY | O_CLOEXEC);
  if (fd < 0)
    return -1;

  bytes_read = TEMP_FAILURE_RETRY (read (fd, &handles, sizeof (handles)));

View on GitHub (pinned to a2409076ef)

Solutions

1. Start a fresh rootless podman instance rather than rejoining the dead one: remove the stale state (podman system reset for the rootless user, or clear ~/.local/share/containers) and rerun
2. Enable lingering for the rootless user so its user+mount namespaces survive logout: loginctl enable-linger USER
3. Confirm you run as the same user (never via sudo) that owns the rootless containers
4. Check for SELinux/AppArmor denials (ausearch -m avc) if namespaces are alive but setns still fails; update podman if the rejoin path is a known-fixed bug

Example fix

# before
sudo podman ps   # mixing rootful sudo with rootless state tries bad namespace joins

# after
loginctl enable-linger $USER
podman ps         # plain rootless, same user that owns the containers

# Before resuming/joining rootless podman, check the owning session is alive
#!/bin/sh
uid=$(id -u)
loginctl show-user "$uid" -p Linger 2>/dev/null | grep -q yes \
  || echo 'warning: linger off — rootless namespaces may vanish on logout' >&2
# stale join handles after reboot/crash: probe cheaply, fall back to fresh state
if ! podman info >/dev/null 2>&1; then
  echo 'podman cannot rejoin its namespaces; consider resetting rootless state' >&2
fi

When it happens

Trigger: Rootless podman re-exec that must rejoin the original user+mount namespaces — e.g. joining an existing rootless podman instance or resuming after pause — when the owning process/session has died, the namespace fds were invalidated (reboot, session teardown), the caller lacks permission over the target userns, or an LSM/seccomp denies setns. The failure happens in C before Go code runs, so podman dies immediately with exit 1.

Common situations: systemd user session ended while podman state implied it could rejoin (no linger); stale files under ~/.local/share/containers/storage or the rootless state dir after a reboot; switching between rootful/rootless against the same DB; hardened kernels or SELinux restricting setns for the user.

Related errors

• cannot write to file descriptor: %m
• cannot write to pipe: %m
• cannot read argv: %m
• cannot fork: %m
• cannot fill sigset: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/b18048ad6d2195d1. Report an issue: GitHub.