podman-container-tools/podman · critical

cannot setresuid: %m

Error message

cannot setresuid: %m

What it means

Companion to setresgid: after joining the existing user+mount namespaces on the shortcut path, the preamble calls setresuid(0,0,0) to become uid 0 inside the user namespace (pkg/rootless/rootless_linux.c:930-935). The source marks this as unrecoverable - failure _exits the process before Go starts. Typical errno is EPERM: seccomp denying setresuid, missing CAP_SETUID, or a UID map without 0 mapped.

Source

Thrown at pkg/rootless/rootless_linux.c:932

joined:
      sprintf (uid_fmt, "%d", uid);
      sprintf (gid_fmt, "%d", gid);

      setenv ("_CONTAINERS_USERNS_CONFIGURED", "init", 1);
      setenv ("_CONTAINERS_ROOTLESS_UID", uid_fmt, 1);
      setenv ("_CONTAINERS_ROOTLESS_GID", gid_fmt, 1);

      /* We are in the user+mount namespace, these errors are not recoverable.  */

      if (syscall_setresgid (0, 0, 0) < 0)
        {
          fprintf (stderr, "cannot setresgid: %m\n");
          _exit (EXIT_FAILURE);
        }

      if (syscall_setresuid (0, 0, 0) < 0)
        {
          fprintf (stderr, "cannot setresuid: %m\n");
          _exit (EXIT_FAILURE);
        }

      if (chdir (cwd) < 0)
        {
          fprintf (stderr, "cannot chdir to %s: %m\n", cwd);
          _exit (EXIT_FAILURE);
        }

      rootless_uid_init = uid;
      rootless_gid_init = gid;
    }
}

static int
syscall_clone (unsigned long flags, void *child_stack)
{
#if defined(__s390__) || defined(__CRIS__)

View on GitHub (pinned to a2409076ef)

Solutions

1. For podman-in-container, apply the documented flags: '--security-opt seccomp=unconfined' and ensure the outer runtime grants the needed capabilities or is itself rootless
2. Confirm basic userns functionality: 'unshare -Ur id' should show uid=0
3. Review seccomp/AppArmor denials in 'journalctl -k' or 'dmesg' for setresuid
4. Collect an strace of the failing call and report upstream with the environment description

# Same probe guards both setresgid and setresuid transitions
unshare -Ur sh -c 'id -u | grep -qx 0' || { echo "cannot become uid 0 in a user namespace here" >&2; exit 1; }
podman "$@"

When it happens

Trigger: Same class as error 35: rootless podman nested in a container blocking set*id syscalls; restrictive seccomp/AppArmor policy on the podman process; user namespace mappings that do not include UID 0 for the joined ns.

Common situations: Docker default seccomp profile applied to an inner podman; hardened CI runners; custom LSM policies; following the setresgid failure once GID succeeded but UID policy blocks the call.

Related errors

• cannot setresgid: %m
• cannot clone: %m\n
• opendir %s: %m
• error opening namespace handles: %m
• cannot chdir to %s: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/68438c586bede757. Report an issue: GitHub.