podman-container-tools/podman · warning

user namespaces are not enabled in %s

Error message

user namespaces are not enabled in %s

What it means

Printed by check_proc_sys_userns_file after syscall_clone(CLONE_NEWUSER|CLONE_NEWNS) already failed in reexec_in_user_namespace (see error 58): podman reads /proc/sys/user/max_user_namespaces or /proc/sys/kernel/unprivileged_userns_clone, and if the value parses to 0 it prints this hint naming the offending sysctl path. It is diagnostic only — no exit, no extra failure — but it identifies the root cause: unprivileged user namespaces are administratively disabled.

Source

Thrown at pkg/rootless/rootless_linux.c:1279

  fprintf (stderr, "failed to reexec: %m\n");

  _exit (EXIT_FAILURE);
}

static void
check_proc_sys_userns_file (const char *path)
{
  FILE *fp;
  fp = fopen (path, "r");
  if (fp)
    {
      char buf[32];
      size_t n_read = fread (buf, 1, sizeof(buf) - 1, fp);
      if (n_read > 0)
        {
          buf[n_read] = '\0';
          if (strtol (buf, NULL, 10) == 0)
            fprintf (stderr, "user namespaces are not enabled in %s\n", path);
        }
      fclose (fp);
    }
}

int
reexec_in_user_namespace (int ready, char *state_dir)
{
  cleanup_free char **argv = NULL;
  cleanup_free char *argv0 = NULL;
  cleanup_free char *cwd = NULL;
  sigset_t sigset, oldsigset;
  int ret;
  pid_t pid;
  char b;
  char uid[16];
  char gid[16];

View on GitHub (pinned to a2409076ef)

Solutions

1. Enable user namespaces: sudo sysctl -w user.max_user_namespaces=28633 (any non-zero value) and persist in /etc/sysctl.d/
2. On Debian: sudo sysctl -w kernel.unprivileged_userns_clone=1
3. If you cannot change host policy, run rootful podman (sudo podman ...)
4. Confirm the fix with: sysctl user.max_user_namespaces kernel.unprivileged_userns_clone and unshare --user --map-root-user true

Example fix

# before
$ sysctl user.max_user_namespaces
user.max_user_namespaces = 0
podman info  # -> user namespaces are not enabled in /proc/sys/user/max_user_namespaces

# after
# sysctl -w user.max_user_namespaces=28633
# echo 'user.max_user_namespaces = 28633' >> /etc/sysctl.d/99-userns.conf
podman info  # works

sysctl -n user.max_user_namespaces | grep -q '^0$' && echo "userns disabled: user.max_user_namespaces=0"
[ -r /proc/sys/kernel/unprivileged_userns_clone ] && sysctl -n kernel.unprivileged_userns_clone | grep -q '^0$' && echo "userns disabled: unprivileged_userns_clone=0"

When it happens

Trigger: clone() failed (any errno, usually EPERM) AND user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0; i.e. any rootless podman startup on a host where the admin or distro disabled unprivileged userns.

Common situations: Hardened enterprise hosts (RHEL-style defaults); older Debian with kernel.unprivileged_userns_clone=0; locked-down CI images; embedded/appliance systems.

Related errors

• cannot clone: %m\n
• cannot read argv: %m
• error getting current working directory: %m\n
• cannot sigdelset(SIGCHLD): %m\n
• cannot sigdelset(SIGTERM): %m\n

AI-assisted analysis of podman-container-tools/podman@a2409076ef (2026-08-15). Data as JSON: /api/errors/6b484b8c8ef94f64. Report an issue: GitHub.