podman-container-tools/podman · critical

failed to reexec: %m

Error message

failed to reexec: %m

What it means

Final step of reexec_userns_join: execvp("/proc/self/exe", argv) re-executes the podman binary inside the new user namespace; if execvp returns at all it failed, the message with %m is printed and the child _exit(EXIT_FAILURE)s. Typical errno: ENOENT when the binary was deleted or replaced (dangling /proc/self/exe), EACCES when the file or its mount is not executable (noexec), ENOEXEC for a corrupt binary, ETXTBSY while the file is being written.

Source

Thrown at pkg/rootless/rootless_linux.c:1261

            {
              if (create_pause_process (state_dir, argv) < 0)
                _exit (EXIT_FAILURE);
            }
          else
            {
              fprintf (stderr, "cannot save namespace handles: %m\n");
              _exit (EXIT_FAILURE);
            }
        }
    }
  if (sigprocmask (SIG_SETMASK, &oldsigset, NULL) < 0)
    {
      fprintf (stderr, "cannot block signals: %m\n");
      _exit (EXIT_FAILURE);
    }

  execvp ("/proc/self/exe", argv);
  fprintf (stderr, "failed to reexec: %m\n");

  _exit (EXIT_FAILURE);
}

static void
check_proc_sys_userns_file (const char *path)
{
  FILE *fp;
  fp = fopen (path, "r");
  if (fp)
    {
      char buf[32];
      size_t n_read = fread (buf, 1, sizeof(buf) - 1, fp);
      if (n_read > 0)
        {
          buf[n_read] = '\0';
          if (strtol (buf, NULL, 10) == 0)
            fprintf (stderr, "user namespaces are not enabled in %s\n", path);

View on GitHub (pinned to a2409076ef)

Solutions

1. Restart the long-running rootless podman process after any upgrade: systemctl --user restart podman.service podman.socket
2. Verify the binary and its mount: ls -l /proc/<pid>/exe /usr/bin/podman; mount | grep -w noexec on the binary's filesystem
3. If /proc/self/exe is dangling (deleted binary), reinstall podman or restart from the new binary
4. Move podman off noexec mounts or remount with exec

# guard long-running rootless services against binary replacement
ls -l /proc/$(pgrep -u $(id -u) podman | head -1)/exe 2>/dev/null  # dangling '(deleted)' = upgrade happened
mount | grep -w noexec | grep -w /usr   # binary mount must be exec

When it happens

Trigger: The podman package was upgraded while a long-running rootless process (podman system service / API listener) was mid-reexec; /proc not mounted so /proc/self/exe cannot resolve; /usr/bin/podman perms changed or resides on a noexec mount; concurrent overwrite of the binary.

Common situations: Unattended upgrades (dnf/apt) replacing podman under a running user service; podman installed on a noexec /opt or /home mount; container images replacing the binary at runtime.

Related errors

• cannot set %s namespace
• cannot write to file descriptor: %m
• cannot write to pipe: %m
• cannot read argv: %m
• cannot fork: %m

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/e42affae2ac0419f. Report an issue: GitHub.