podman-container-tools/podman · error

execve: %m

Error message

execve: %m

What it means

execve(argv[0], argv, NULL) failed in the fork_exec_ps() child of 'podman top': the ps binary could not be executed. %m is strerror(errno): ENOENT (binary or its ELF interpreter/linker vanished or path wrong), EACCES (noexec mount, missing execute permission, path traversal denied), ENOEXEC, ETXTBSY, or ENOMEM. argv[0] is the ps path validated read-only moments earlier in podmanTopInner, so failures usually come from the mount environment (noexec) or dynamic-loader problems in a minimal image. Exit code 255 (special_exit_code).

Source

Thrown at libpod/container_top_linux.c:95

        {
          // join the userns to make sure uid mapping match
          // we are already part of the pidns so so pid 1 is the main container process
          r = open ("/proc/1/ns/user", O_CLOEXEC | O_RDONLY);
          if (r < 0)
            {
              fprintf (stderr, "open /proc/1/ns/user: %m");
              exit (special_exit_code);
            }
          if ((status = setns (r, CLONE_NEWUSER)) < 0)
            {
              fprintf (stderr, "setns NEWUSER: %m");
              exit (special_exit_code);
            }
        }

      /* use execve to unset all env vars, we do not want to leak anything into the container */
      execve (argv[0], argv, NULL);
      fprintf (stderr, "execve: %m");
      exit (special_exit_code);
    }

  r = waitpid (pid, &status, 0);
  if (r < 0)
    {
      fprintf (stderr, "waitpid: %m");
      exit (special_exit_code);
    }
  if (WIFEXITED (status))
    exit (WEXITSTATUS (status));
  if (WIFSIGNALED (status))
    exit (128 + WTERMSIG (status));
  exit (special_exit_code);
}

View on GitHub (pinned to a2409076ef)

Solutions

1. Verify ps works in the container directly: podman exec CTOR ps aux
2. Install procps in the image (e.g. RUN apt-get install -y procps or apk add procps) so a working ps ships with the image
3. Check container storage is not mounted noexec (findmnt -no OPTIONS /var/lib/containers/storage) and remount exec if safe
4. For SELinux denials, inspect ausearch -m avc and adjust labels/policy

Example fix

# before (Dockerfile)
FROM alpine
COPY app /app

# after
FROM alpine
RUN apk add --no-cache procps
COPY app /app

# Confirm the container's ps is executable before podman top uses it
#!/bin/sh
if podman exec "$ctr" sh -c 'command -v ps >/dev/null && ps --version >/dev/null 2>&1 || ps -V >/dev/null 2>&1' 2>/dev/null; then
  exec podman top "$ctr"
fi
echo "ps not usable inside $ctr — install procps in the image" >&2
exit 1

When it happens

Trigger: 'podman top CTOR' where the ps binary sits on a noexec filesystem (image layers under a noexec overlay/tmpfs), the container image's ps is a dynamically linked binary whose loader/libs are absent, an architecture/ABI mismatch, or the path disappeared between validation and exec.

Common situations: Minimal images (distroless, busybox-based with a foreign ps copy) lacking libc/loader for ps; hosts mounting container storage with noexec (graphroot on a noexec partition); SELinux denying execution from container_file_t in unusual configurations.

Related errors

• failed to allocate ps argv
• fork: %m
• mount proc: %m
• open /proc/1/ns/user: %m
• setns NEWUSER: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/03ea803ebbcb4f7e. Report an issue: GitHub.