podman-container-tools/podman · error

error opening namespace handles: %m

Error message

error opening namespace handles: %m

What it means

The shortcut path tries to reopen the cached namespace file descriptors stored under '$XDG_RUNTIME_DIR/libpod/tmp/ns_handles' via set_ns_handles() (name_to_handle_at/open_by_handle_at machinery). Known-recoverable errnos are handled: ESTALE returns to the re-exec path, and ENOENT/EOPNOTSUPP/ENOSYS/EPERM fall back to the pause.pid mechanism (pkg/rootless/rootless_linux.c:858-868). This fatal message means the error was none of those - e.g. EMFILE/ENFILE (fd exhaustion) or an unexpected LSM/seccomp errno - so the process _exits.

Source

Thrown at pkg/rootless/rootless_linux.c:865

        }

      if (set_ns_handles (path) == 0)
        goto joined;

      /* If the handle is stale, give up with the shortcut.  */
      if (errno == ESTALE)
        return;

      /* Fall back to pause.pid if:
         - ENOENT ns_handles file doesn't exist
         - EOPNOTSUPP kernel doesn't support open_by_handle_at
         - ENOSYS syscall not available
         - EPERM (could be seccomp when running in a container)
       */
      if (errno != ENOENT && errno != EOPNOTSUPP && errno != ENOSYS && errno != EPERM)
        {
          /* Anything else is fatal.  */
          fprintf (stderr, "error opening namespace handles: %m\n");
          _exit (EXIT_FAILURE);
        }

      /* Fall back to pause.pid for compatibility with older versions or if the kernel is too old.  */
      len = snprintf (path, PATH_MAX, "%s/libpod/tmp/pause.pid", xdg_runtime_dir);
      if (len >= PATH_MAX)
        {
          errno = ENAMETOOLONG;
          fprintf (stderr, "invalid value for XDG_RUNTIME_DIR: %m");
          exit (EXIT_FAILURE);
        }

      fd = open (path, O_RDONLY);
      if (fd < 0)
        return;

      r = TEMP_FAILURE_RETRY (read (fd, buf, sizeof (buf) - 1));
      if (r < 0)

View on GitHub (pinned to a2409076ef)

Solutions

1. Check fd usage and limits: 'ulimit -n' and 'ls /proc/$$/fd | wc -l'; raise the limit ('ulimit -n 4096' or systemd DefaultLIMIT_NOFILE) and retry
2. Check the exact errno in the printed message and match it against the whitelisted set to identify an LSM/seccomp interposer
3. Close fd-heavy applications or log out/in to reset the session, then retry
4. Report upstream with the errno string, kernel version, and whether the ns_handles file exists in $XDG_RUNTIME_DIR/libpod/tmp

Example fix

# before
$ ulimit -n
1024
$ podman ps   # error opening namespace handles: Too many open files

# after
$ ulimit -n 4096
$ podman ps

# Ensure fd headroom for opening the namespace handles
used=$(ls /proc/$$/fd 2>/dev/null | wc -l); max=$(ulimit -n)
if [ "$used" -ge $((max - 64)) ]; then
  ulimit -n "$((max * 2))" 2>/dev/null || echo "raise RLIMIT_NOFILE before running podman" >&2
fi
podman "$@"

When it happens

Trigger: The user session is at its RLIMIT_NOFILE ceiling when podman tries to open the namespace handles (EMFILE/ENFILE); an unusual security policy denies open_by_handle_at with an errno outside the whitelisted set; a kernel/filesystem combination returning an exotic error for the stored handle.

Common situations: Long-lived desktop sessions or IDEs that consume thousands of fds, then launch a rootless podman; podman nested inside custom sandboxes with nonstandard seccomp filters; very new or very old kernels after a podman upgrade introduced the ns_handles fast path.

Related errors

• cannot setresgid: %m
• cannot setresuid: %m
• cannot chdir to %s: %m
• cannot block signals: %m
• cannot prctl(PR_SET_PDEATHSIG): %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/408500343e6257c9. Report an issue: GitHub.