container preflight fails: newuidmap not on the lab unit PATH (rootless podman) #228

New issue

Closed

opened 2026-07-25 14:34:34 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-07-25 14:34:34 +02:00

Owner

Starting a containerized agent is refused by preflight:

container preflight failed: podman: podman version: exit status 125: Error: command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH (install podman >= 4)

Diagnosis

podman 5.8.2 IS installed and on the unit PATH — the "install podman >= 4" hint is a red herring. podman fails during rootless user-namespace setup, before dispatching the version subcommand.
The host is otherwise correctly provisioned: /etc/subuid / /etc/subgid carry lab:100000:65536, and setuid newuidmap/newgidmap exist in /run/wrappers/bin (NixOS security wrappers).
But nix/module.nix builds the lab unit PATH exclusively from nix store packages (deliberately — since #202 the unit PATH is the only tool source), and /run/wrappers/bin is not on it. Rootless podman cannot map its subordinate ID range without setuid newuidmap/newgidmap, and a nix package can never provide one (the store forbids setuid bits), so this is only fixable at the unit-PATH level.
Confirmed: PATH=/run/wrappers/bin:$PATH podman version succeeds on the affected host.

Fix

Add "/run/wrappers" to the container-gated path list in nix/module.nix (NixOS appends /bin via makeBinPath — standard nixpkgs idiom for units needing setuid helpers).
Extend the flake's nixos-module unit-text checks: /run/wrappers/bin must appear on the container-enabled (and default, container-on-by-default per #220) unit PATH line, and must NOT leak onto a container-disabled unit.

Note: podman's stderr is already folded into the preflight failure detail by ExecRunner, which is how the real cause surfaced — no change needed there.

Starting a containerized agent is refused by preflight: container preflight failed: podman: podman version: exit status 125: Error: command required for rootless mode with multiple IDs: exec: "newuidmap": executable file not found in $PATH (install podman >= 4) ## Diagnosis - podman 5.8.2 IS installed and on the unit PATH — the "install podman >= 4" hint is a red herring. podman fails during rootless user-namespace setup, before dispatching the `version` subcommand. - The host is otherwise correctly provisioned: `/etc/subuid` / `/etc/subgid` carry `lab:100000:65536`, and setuid `newuidmap`/`newgidmap` exist in `/run/wrappers/bin` (NixOS security wrappers). - But `nix/module.nix` builds the lab unit PATH exclusively from nix store packages (deliberately — since #202 the unit PATH is the only tool source), and `/run/wrappers/bin` is not on it. Rootless podman cannot map its subordinate ID range without setuid newuidmap/newgidmap, and a nix package can never provide one (the store forbids setuid bits), so this is only fixable at the unit-PATH level. - Confirmed: `PATH=/run/wrappers/bin:$PATH podman version` succeeds on the affected host. ## Fix - Add `"/run/wrappers"` to the container-gated `path` list in `nix/module.nix` (NixOS appends `/bin` via makeBinPath — standard nixpkgs idiom for units needing setuid helpers). - Extend the flake's nixos-module unit-text checks: `/run/wrappers/bin` must appear on the container-enabled (and default, container-on-by-default per #220) unit PATH line, and must NOT leak onto a container-disabled unit. Note: podman's stderr is already folded into the preflight failure detail by ExecRunner, which is how the real cause surfaced — no change needed there.

dominik.polakovics referenced this issue from a commit

2026-07-25 14:38:04 +02:00

fix(nix): put /run/wrappers on the container unit PATH (issue #228)

dominik.polakovics referenced this issue from a pull request that will close it,

2026-07-25 14:38:16 +02:00

fix(nix): put /run/wrappers on the container unit PATH #229

dominik.polakovics closed this issue

2026-07-25 15:33:51 +02:00