Fix: Rootless Podman-in-Podman on WSL #27412

dvorst · 2025-10-30T20:32:04Z

pkg/machine/wsl/declares.go

Adjust SUB_UID and SUB_GID ranges to support running rootless Podman inside a rootless run Podman container.

By default, a new user is assigned the following sub-ID ranges:
SUB_UID_MIN=100000, SUB_GID_MIN=100000, SUB_UID_COUNT=65536, SUB_GID_COUNT=65536
This means the user’s sub-UID and sub-GID ranges are 100000–165535.

When the container is run rootless by the user in WSL, ID mappings occur as follows:

Container ID 0 (root) maps to user ID 1000 on the host (user in WSL).
Container IDs 1–65536 map to IDs 100000–165535 on host (the subid range previously mentioned).

If a new user is created inside this container (to build containers for example), it will attempt to use the default sub-ID range (100000–165535). However, this exceeds the container’s available ID mapping, since only IDs up to 65536 are mapped, causing rootless PinP to fail.

To enable container-in-container builds, the sub-ID ranges for the user in WSL must be large enough to provide at least 65536 usable IDs. A minimum SUB_UID_COUNT and SUB_GID_COUNT of 165536 is thus required, but 200000 is used here to provide additional margin.

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Fixed Rootless Podman-in-Podman on WSL, by sufficiently increasing the SUB_GID and SUB_UID range of the user on WSL (#27411).

openshift-ci · 2025-10-30T20:32:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dvorst
Once this PR has been reviewed and has the lgtm label, please assign tomsweeneyredhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

packit-as-a-service · 2025-10-30T20:36:18Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

baude · 2025-10-31T12:45:37Z

i think you should add a test to the PR that validates your change; otherwise, if we change how the image is built or someone makes an unknowing chnage, you could easily have a regression. wdyt ?

also thanks for your diligence on this this PR.

otherwise, this LGTM

dvorst · 2025-10-31T16:13:52Z

Sure, I can add a test. Had a quick look at the tests dir but it isn't clear to me at first sight where I should place it. Can you point me in the right direction? Maybe there are already tests that I can use to start from

TomSweeneyRedHat · 2025-10-31T20:00:05Z

@dvorst thanks for the PR!
If @baude says differently, go with his thinking. Otherwise the machine tests live in ./pkg/machine/e2e

TomSweeneyRedHat · 2025-10-31T20:00:20Z

And code LGTM too

closes: containers#27411 Adjust SUB_UID and SUB_GID ranges to support running rootless Podman inside a rootless run Podman container. By default, a new user is assigned the following sub-ID ranges: SUB_UID_MIN=100000, SUB_GID_MIN=100000, SUB_UID_COUNT=65536, SUB_GID_COUNT=65536 This means the user’s sub-UID and sub-GID ranges are 100000–165535. When the container is run rootless with the user defined below, ID mappings occur as follows: - Container ID 0 (root) maps to user ID 1000 on the host (which is the user created below). - Container IDs 1–65536 map to IDs 100000–165535 on host (the subid range previously mentioned). If a new user is created inside this container (to build containers for example), it will attempt to use the default sub-ID range (100000–165535). However, this exceeds the container’s available ID mapping, since only IDs up to 65536 are mapped. This causes nested rootless Podman to fail. To enable container-in-container builds, the sub-ID ranges for the user must be large enough to provide at least 65536 usable IDs. A minimum SUB_UID_COUNT and SUB_GID_COUNT of 165536 is required, but 200000 is used here to provide additional margin. Signed-off-by: dvorst <[email protected]>

in pkg/machine/e2e/init_test.go Signed-off-by: dvorst <[email protected]>

Luap99

You need to rebase your PR to pass the search failure in the integration tests (not related to your code).

And please squash both commits into one, we prefer code and test in the same commits.

Luap99 · 2025-11-03T18:24:05Z

pkg/machine/wsl/declares.go

+sed -ir 's/SUB_UID_COUNT.*/SUB_UID_COUNT 200000/' /etc/login.defs
+sed -ir 's/SUB_GID_COUNT.*/SUB_GID_COUNT 200000/' /etc/login.defs


This is fixing this differently on WSL than compared to our providers which only set a range for the one user we create by writing subuid/subgid directly. So I would rather match that.

podman/pkg/machine/ignition/ignition.go

Lines 284 to 289 in 69b397a

subUID := 100000

subUIDs := 1000000

if uid >= subUID && uid < (subUID+subUIDs) {

subUID = uid + 1

}

etcSubUID := fmt.Sprintf(`%s:%d:%d`, usrName, subUID, subUIDs)

In particular they use a range of 1000000 uids not 200000 which I think is important to keep the behaviours consistent between providers

Luap99 · 2025-11-03T18:28:24Z

pkg/machine/e2e/init_test.go

+	It("init subid range check for rootless PinP", func() {
+		/* By default, a new user is assigned the following sub-ID ranges (see manual useradd):
+		 * SUB_UID_MIN=100000, SUB_GID_MIN=100000, SUB_UID_COUNT=65536, SUB_GID_COUNT=65536
+		 * This means the default sub-UID and sub-GID ranges are 100000–165535.
+		 *
+		 * When the container is run rootless by the user in WSL, ID mappings occur as follows:
+		 * Container ID 0 (root) maps to user ID on the host.
+		 * Container IDs 1–65536 map to IDs 100000–165535 on host (range previously mentioned).
+		 *
+		 * If a new user is created inside the container and used to build containers with
+		 * (rootless PinP), it will attempt to use the default sub-ID range (100000–165535). Given
+		 * the mapping, this means that the host must at least have a SUB_UID_COUNT and
+		 * SUB_GID_COUNT of 165536. Since 165536 would only allow rootless PinP for the first
+		 * user (with ID 1000), the check is run against a count of 166536 (=165536+1000) as to
+		 * provide additional margin.
+		 */


rootless PinP is not really relevant to this test at all, it could just be called check subuid/gid ranges.

But in any case adding new test cases is quite slow as they all require new Vm to be created. As such I would strongly advise to not a a new It() block for something simple as this. Instead just add a new ssh command at the end of simple init with username for example

Luap99 · 2025-11-03T18:29:08Z

pkg/machine/e2e/init_test.go

+		if sshSession.ExitCode() != 0 {
+			Fail(fmt.Sprintf("SSH session failed with exit code %d\nstdout:\n%s\nstderr:\n%s",
+				sshSession.ExitCode(),
+				sshSession.outputToString(),
+				sshSession.errorToString(),
+			))
+		}


That doesn't add anything so please don't do that.

Luap99 · 2025-11-03T18:31:07Z

pkg/machine/e2e/init_test.go

+		// A user must exist in order to run podman rootless, a line in both subuid and subgid
+		// should exist for it, so 2 lines in total.
+		Expect(len(counts)).To(BeNumerically(">=", 2), "expected at least 1 user/line in /etc/subuid and /etc/subgid each, got %d", len(counts))
+
+		// Verify the count. At the moment only 1 user is created in the machine. If multiple users
+		// are ever created, this will check that all users have a sufficient subid range.
+		for _, count := range counts {
+			n, err := strconv.Atoi(count[1])
+			Expect(err).ToNot(HaveOccurred())
+			Expect(n).To(BeNumerically(">=", count_min), "expected last number %d to be >= %d", n, count_min)
+		}


There should be no reason to harden that for multiple user we only ever create one and should not create multiple. If that ever were to be the case we can adapt tests later. For now I don't see the value in complicating the check for this.

openshift-ci bot added the release-note label Oct 30, 2025

github-actions bot added the machine label Oct 30, 2025

dvorst mentioned this pull request Oct 30, 2025

Bug: Rootless Podman-in-Podman on WSL #27411

Open

dvorst force-pushed the fix/rootless-podman-in-podman-on-wsl branch from dd60c4b to 9c4dbb1 Compare October 30, 2025 20:35

dvorst force-pushed the fix/rootless-podman-in-podman-on-wsl branch 7 times, most recently from e998a89 to 3772eff Compare November 3, 2025 09:55

dvorst force-pushed the fix/rootless-podman-in-podman-on-wsl branch 7 times, most recently from d702dfc to 67371a5 Compare November 3, 2025 18:00

Test: init subid range check for rootless PinP

67371a5

in pkg/machine/e2e/init_test.go Signed-off-by: dvorst <[email protected]>

Luap99 reviewed Nov 3, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix: Rootless Podman-in-Podman on WSL #27412

Fix: Rootless Podman-in-Podman on WSL #27412

dvorst commented Oct 30, 2025 •

edited

Loading

Uh oh!

openshift-ci bot commented Oct 30, 2025

Uh oh!

packit-as-a-service bot commented Oct 30, 2025

Uh oh!

baude commented Oct 31, 2025

Uh oh!

dvorst commented Oct 31, 2025

Uh oh!

TomSweeneyRedHat commented Oct 31, 2025

Uh oh!

TomSweeneyRedHat commented Oct 31, 2025

Uh oh!

Luap99 left a comment

Uh oh!

Luap99 Nov 3, 2025

Uh oh!

Luap99 Nov 3, 2025

Uh oh!

Luap99 Nov 3, 2025

Uh oh!

Luap99 Nov 3, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		sed -ir 's/SUB_UID_COUNT.*/SUB_UID_COUNT 200000/' /etc/login.defs
		sed -ir 's/SUB_GID_COUNT.*/SUB_GID_COUNT 200000/' /etc/login.defs

	subUID := 100000
	subUIDs := 1000000
	if uid >= subUID && uid < (subUID+subUIDs) {
	subUID = uid + 1
	}
	etcSubUID := fmt.Sprintf(`%s:%d:%d`, usrName, subUID, subUIDs)

Fix: Rootless Podman-in-Podman on WSL #27412

Are you sure you want to change the base?

Fix: Rootless Podman-in-Podman on WSL #27412

Conversation

dvorst commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

pkg/machine/wsl/declares.go

Checklist

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Oct 30, 2025

Uh oh!

packit-as-a-service bot commented Oct 30, 2025

Uh oh!

baude commented Oct 31, 2025

Uh oh!

dvorst commented Oct 31, 2025

Uh oh!

TomSweeneyRedHat commented Oct 31, 2025

Uh oh!

TomSweeneyRedHat commented Oct 31, 2025

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Luap99 Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dvorst commented Oct 30, 2025 •

edited

Loading