Podman: cannot set up namespace using "/usr/bin/newuidmap"

[tarun360]

I faced a transient error with podman, as follows:

$ podman images
ERRO[0000] running `/usr/bin/newuidmap 126747 0 21363 1 1 2000000 65536 65537 2000000 65536 131073 2000000 65536 196609 2000000 65536 262145 1334579568 65536`: newuidmap: write to uid_map failed: Invalid argument 
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1
$ podman pull some_remote_image
ERRO[0000] running `/usr/bin/newuidmap 126694 0 21363 1 1 2000000 65536 65537 2000000 65536 131073 2000000 65536 196609 2000000 65536 262145 1334579568 65536`: newuidmap: write to uid_map failed: Invalid argument 
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

I was able to get around this error by specifying --cgroup-manager=cgroupfs, as follows:

$ podman --cgroup-manager cgroupfs images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

After specifying the cgroup manager as cgroupfs once (as above), I now no longer get the above errors, whether I specify cgroup manager as systemd or as cgroupfs.

$ podman --cgroup-manager systemd images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE
$ podman --cgroup-manager cgroupfs images
REPOSITORY  TAG         IMAGE ID    CREATED     SIZE

Since I am unable to reproduce the above transient error, I am unable to find the root cause for this. Does anyone have an idea about the cause of the above error, and how I can prevent it in future?

[vrothberg]

Thanks for reachign out, @tarun360!
@giuseppe PTAL

[giuseppe]

how does the configuration in /etc/subuid and /etc/subgid look like?

Is your user added there as part of the assigned ranges?

[giuseppe]

is your user name also present there (not just the UID)?

[tarun360]

My username is not present there, just the UID is present.

show the entire file

Apologies, but I can't share the entire file due to regulatory reasons. If you want me to grep something, I can help with that.

[giuseppe]

are you sure your system is configured to use /etc/subuid and not IPA (https://freeipa.readthedocs.io/en/latest/designs/subordinate-ids.html)?

[tarun360]

Could you please tell how can I check that?

[giuseppe]

use the getsubids tool.

getsubids $YOUR_USER_NAME