Different behavior between rootful and rootless with --userns=auto #27914
Description
Issue Description
Currently, I am trying to take the best of both worlds, see also #13728.
However, it appears that despite expanding the sub UID/GID range (size), the behavior between rootful and rootless differs with ``--userns=auto` - to be precise, it does not function with rootless.
Steps to reproduce the issue
To do this, I extended the subuid (and subguid, of course) as follows:
$ cat /etc/subgid
# user rootless containers, CoreOS default: core:524288:65536
core:100000:536870912
# rootful containers
containers:2147483647:2147483648Note that the start ID is not default with CoreOS (but it is default with shadow utils'? login.defs). Without this change, I expect and get (other containers still running) the error: Error: creating container storage: not enough unused IDs in user namespace when starting rootless containers with --userns=auto.
Let's start with the expected behavior for rootful containers:
$ sudo podman run -d --rm --name alpi1 --userns=auto alpine:3 ash -c "sleep infinity"
Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:3...
[...]
71e2f1db292d73e5b0165fd1550213ee7445ca8457a66f04752768232f00a055
$ sudo podman run -d --rm --name alpi2 --userns=auto alpine:3 ash -c "sleep infinity"
a570e4b60b45103c50db010be0f0f81a7e227c7009dd14f02f39c1bdce2462b3
$ sudo podman run -d --rm --name alpi3 --userns=auto alpine:3 ash -c "sleep infinity"
386b6db936732c4add3dd2020279d569264022bb6a40c4c0f96970879ad8cd89
$ sudo podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
71e2f1db292d docker.io/library/alpine:3 ash -c sleep infi... 21 seconds ago Up 21 seconds alpi1
a570e4b60b45 docker.io/library/alpine:3 ash -c sleep infi... 12 seconds ago Up 12 seconds alpi2
386b6db93673 docker.io/library/alpine:3 ash -c sleep infi... 6 seconds ago Up 6 seconds alpi3
$ sudo podman exec alpi1 cat /proc/self/uid_map
0 2147483647 1024
$ sudo podman exec alpi2 cat /proc/self/uid_map
0 2147484671 1024
$ sudo podman exec alpi3 cat /proc/self/uid_map
0 2147485695 1024Tested on a fresh installation of CoreOS stable. Everything as expected.
Now let's move on to rootless containers (still the same subuid settings) – and this is where things get strange:
podman run ... --userns=auto ...
Error: creating container storage: not enough unused IDs in user namespaceI didn't expect that. Now I set the start ID of the user core to the original/CoreOS stock/default value, which is also defined in /etc/login.defs, size remains the bigger one:
$ cat /etc/subuid
# user rootless containers, CoreOS default: core:524288:65536
core:524288:536870912
# rootful containers
containers:2147483647:2147483648
$ cat /etc/login.defs | grep SUB_
SUB_UID_MIN 524288
SUB_UID_MAX 600100000
SUB_UID_COUNT 65536
SUB_GID_MIN 524288
SUB_GID_MAX 600100000
SUB_GID_COUNT 65536and reload podman with podman system migrate and try my luck again:
$ podman run -d --rm --name alpi1 --userns=auto alpine:3 ash -c "sleep infinity"
Error: creating container storage: creating an ID-mapped copy of layer "7bb20cf5ef67526cb843d264145241ce4dde09a337b5be1be42ba464de9a672d": error during chown: storage-chown-by-maps: lchown etc/shadow: operation not permitted: exit status 1I wouldn't have expected that either. A reboot just now doesn't change anything. --privileged doesn't change the behaviour.
Describe the results you received
see above.
Describe the results you expected
see above.
podman info output
host:
arch: amd64
buildahVersion: 1.42.2
cgroupControllers:
- cpu
- memory
- pids
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon-2.1.13-2.fc43.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.1.13, commit: '
cpuUtilization:
idlePercent: 98.6
systemPercent: 0.88
userPercent: 0.52
cpus: 4
databaseBackend: sqlite
distribution:
distribution: fedora
variant: coreos
version: "43"
eventLogger: journald
freeLocks: 2045
hostname: coreos-playground
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 524288
size: 536870912
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 524288
size: 536870912
kernel: 6.17.11-300.fc43.x86_64
linkmode: dynamic
logDriver: journald
memFree: 7719096320
memTotal: 8306880512
networkBackend: netavark
networkBackendInfo:
backend: netavark
dns:
package: aardvark-dns-1.17.0-1.fc43.x86_64
path: /usr/libexec/podman/aardvark-dns
version: aardvark-dns 1.17.0
package: netavark-1.17.1-1.fc43.x86_64
path: /usr/libexec/podman/netavark
version: netavark 1.17.1
ociRuntime:
name: crun
package: crun-1.25.1-1.fc43.x86_64
path: /usr/bin/crun
version: |-
crun version 1.25.1
commit: 156ae065d4a322d149c7307034f98d9637aa92a2
rundir: /run/user/1000/crun
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
os: linux
pasta:
executable: /usr/bin/pasta
package: passt-0^20250919.g623dbf6-1.fc43.x86_64
version: |
pasta 0^20250919.g623dbf6-1.fc43.x86_64-pasta
Copyright Red Hat
GNU General Public License, version 2 or later
<https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
remoteSocket:
exists: true
path: /run/user/1000/podman/podman.sock
rootlessNetworkCmd: pasta
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: true
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns-1.3.1-3.fc43.x86_64
version: |-
slirp4netns version 1.3.1
commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
libslirp: 4.9.1
SLIRP_CONFIG_VERSION_MAX: 6
libseccomp: 2.6.0
swapFree: 4153405440
swapTotal: 4153405440
uptime: 0h 16m 42.00s
variant: ""
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries:
search:
- registry.fedoraproject.org
- registry.access.redhat.com
- docker.io
store:
configFile: /var/home/core/.config/containers/storage.conf
containerStore:
number: 0
paused: 0
running: 0
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: /var/home/core/.local/share/containers/storage
graphRootAllocated: 50933530624
graphRootUsed: 2001354752
graphStatus:
Backing Filesystem: xfs
Native Overlay Diff: "true"
Supports d_type: "true"
Supports shifting: "false"
Supports volatile: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 5
runRoot: /run/user/1000/containers
transientStore: false
volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
APIVersion: 5.7.1
BuildOrigin: Fedora Project
Built: 1765324800
BuiltTime: Wed Dec 10 01:00:00 2025
GitCommit: f845d14e941889ba4c071f35233d09b29d363c75
GoVersion: go1.25.4 X:nodwarf5
Os: linux
OsArch: linux/amd64
Version: 5.7.1
$ rpm -q podman
podman-5.7.1-1.fc43.x86_64Podman in a container
No
Privileged Or Rootless
None
Upstream Latest Release
Yes
Additional environment details
No additional environment details
Additional information
I don't remember reading that userns=auto shouldn't work with these changes to the subordinate ID to rootless containers. Or did I overlook something?
BTW, the pull-down menu "Privileged Or Rootless" is missing the "both" option ;-)