podman-container-tools/podman · critical

cannot setresgid: %m

Error message

cannot setresgid: %m

What it means

After successfully joining the existing user+mount namespaces via the shortcut, the preamble becomes 'root' inside the user namespace: setresgid(0,0,0) is called before setresuid (pkg/rootless/rootless_linux.c:923-929). The source comment marks these errors as not recoverable in the joined namespace, and the process _exits on failure. Typical errno is EPERM from a security policy (seccomp filtering setresgid, missing CAP_SETGID) or an incomplete GID mapping.

Source

Thrown at pkg/rootless/rootless_linux.c:926

          return;
        }

      /* This is a fatal error we can't recover from since we have already joined the userns.  */
      join_namespace_or_die ("mnt", mntns_fd);

joined:
      sprintf (uid_fmt, "%d", uid);
      sprintf (gid_fmt, "%d", gid);

      setenv ("_CONTAINERS_USERNS_CONFIGURED", "init", 1);
      setenv ("_CONTAINERS_ROOTLESS_UID", uid_fmt, 1);
      setenv ("_CONTAINERS_ROOTLESS_GID", gid_fmt, 1);

      /* We are in the user+mount namespace, these errors are not recoverable.  */

      if (syscall_setresgid (0, 0, 0) < 0)
        {
          fprintf (stderr, "cannot setresgid: %m\n");
          _exit (EXIT_FAILURE);
        }

      if (syscall_setresuid (0, 0, 0) < 0)
        {
          fprintf (stderr, "cannot setresuid: %m\n");
          _exit (EXIT_FAILURE);
        }

      if (chdir (cwd) < 0)
        {
          fprintf (stderr, "cannot chdir to %s: %m\n", cwd);
          _exit (EXIT_FAILURE);
        }

      rootless_uid_init = uid;
      rootless_gid_init = gid;
    }

View on GitHub (pinned to a2409076ef)

Solutions

1. If nesting podman in a container, run the outer container with the documented rootless-in-container settings: '--security-opt seccomp=unconfined' --cap-add SETGID,SETUID or use the official podman-in-container guidance
2. Verify user namespace support works at all: 'unshare -Ur true' should succeed as the same user
3. Check sysctl kernel.unprivileged_userns_clone=1 (Debian/older Ubuntu) and user.max_user_namespaces > 0
4. If the environment is correct and it still fails, capture 'strace -f -e trace=setresgid podman <cmd>' and report upstream

Example fix

# before
$ docker run --rm quay.io/podman/stable podman ps
cannot setresgid: Operation not permitted

# after
$ docker run --rm --security-opt seccomp=unconfined --cap-add=SYS_ADMIN quay.io/podman/stable podman ps

# Verify the environment permits the set*id transition rootless podman needs
if ! unshare -Ur true 2>/dev/null; then
  echo "user namespaces or setresgid/setresuid are blocked here" >&2
  exit 1
fi
podman "$@"

if ! podman "$@"; then
  rc=$?
  # 'cannot setresgid: Operation not permitted' -> inspect the sandbox policy
  unshare -Ur true || echo "environment blocks set*id in user namespaces" >&2
  exit "$rc"
fi

When it happens

Trigger: Running rootless podman inside an unprivileged container whose seccomp profile or capability set blocks setresgid; a nested-userns environment where GID 0 is not mapped in the joined user namespace; AppArmor/LSM rules denying the syscall.

Common situations: Podman-in-podman / Docker-in-Docker setups running the inner podman without '--security-opt seccomp=unconfined' and proper caps; CI images that strip capabilities; security-hardened hosts restricting set*id syscalls.

Related errors

• cannot setresuid: %m
• cannot clone: %m\n
• opendir %s: %m
• error opening namespace handles: %m
• cannot chdir to %s: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/129f6597f662a609. Report an issue: GitHub.