rootless podman in rootless podman : [cannot set user namespace]

[Hui012]

Hi all, I am trying to create rootless podman, reference here: Podman inside of a container
when i run podman info command, return [cannot set user namespace]

my command

1. podman run -it --user podman --security-opt label=disable --device /dev/fuse podman-ubi:latest

   return cannot set user namespace

2. podman run --privileged -it --user podman --security-opt label=disable --device /dev/fuse podman-ubi:latest

   inside podman is work.

podman version 4.2.0

Thanks.

[giuseppe]

without privileges or a privileged helper (like newuidmap/newgidmap), the first command is not able to setup the user namespace.

If you are already running privileged, with capabilities, then the user namespace can be configured.

[Hui012]

This problem occur in local machine, but first command in my gcp environment is work.
I don't know why and very confused.

[rhatdan]

You need to create your image similar to quay.io/podman/stable

https://github.com/containers/podman/tree/main/contrib/podmanimage/stable

[Hui012]

yes, I have created my image

[Hui012]

Update debug message

podman info --log-level debug

INFO[0000] podman filtering at log level debug
DEBU[0000] Called info.PersistentPreRunE(podman --log-level debug info)
DEBU[0000] Merged system config "/usr/share/containers/containers.conf"
DEBU[0000] Merged system config "/etc/containers/containers.conf"
DEBU[0000] Merged system config "/home/podman/.config/containers/containers.conf"
DEBU[0000] Using conmon: "/usr/bin/conmon"
DEBU[0000] Initializing boltdb state at /home/podman/.local/share/containers/storage/libpod/bolt_state.db
DEBU[0000] Using graph driver overlay
DEBU[0000] Using graph root /home/podman/.local/share/containers/storage
DEBU[0000] Using run root /tmp/containers-user-1000/containers
DEBU[0000] Using static dir /home/podman/.local/share/containers/storage/libpod
DEBU[0000] Using tmp dir /tmp/podman-run-1000/libpod/tmp
DEBU[0000] Using volume path /home/podman/.local/share/containers/storage/volumes
DEBU[0000] Set libpod namespace to ""
DEBU[0000] Not configuring container store
DEBU[0000] Initializing event backend file
DEBU[0000] Configured OCI runtime krun initialization failed: no valid executable found for OCI runtime krun: invalid argument
DEBU[0000] Configured OCI runtime runj initialization failed: no valid executable found for OCI runtime runj: invalid argument
DEBU[0000] Configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument
DEBU[0000] Configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument
DEBU[0000] Using OCI runtime "/usr/bin/crun"
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
cannot set user namespace
DEBU[0000] Failed to add pause process to systemd sandbox cgroup: exec: "dbus-launch": executable file not found in $PATH