Buildah "cannot set up namespace ... operation not permitted" in CI

Rootless Buildah builds inside a user namespace so it can map a range of UIDs without real root. When /etc/subuid and /etc/subgid have no range for the user, newuidmap is missing, or the container forbids namespace creation, setup fails with operation not permitted.

What this error means

Buildah fails with "cannot set up namespace using ... : operation not permitted" or "user namespaces are not enabled" when starting a rootless build in a container-based CI runner.

buildah

ERRO[0000] cannot set up namespace using "/usr/bin/newuidmap":
exit status 1: newuidmap: write to uid_map failed: Operation not permitted
Error: setup network: operation not permitted

Common causes

No subuid/subgid range for the build user

Rootless mapping needs a range in /etc/subuid and /etc/subgid for the user. Without it, newuidmap cannot write the uid_map.

The CI container forbids user namespace creation

A GitLab Kubernetes executor pod (or a container without the right caps) may block CLONE_NEWUSER, so no user namespace can be created.

How to fix it

Provide subuid/subgid and the setuid uidmap tools

Add a range in /etc/subuid and /etc/subgid for the build user.
Ensure newuidmap/newgidmap are installed and setuid (shadow-utils / uidmap).
Install fuse-overlayfs so rootless storage works without overlay caps.

Terminal

echo "build:100000:65536" >> /etc/subuid
echo "build:100000:65536" >> /etc/subgid

Or run privileged / with the caps Buildah needs

If rootless namespaces cannot be enabled in your runner, run the build container privileged (or with SETUID/SETGID and namespace access).

pod.yaml

# GitLab Kubernetes executor: allow the namespace setup
securityContext:
  privileged: true

How to prevent it

Provision /etc/subuid and /etc/subgid ranges in the build image.
Install the uidmap package so newuidmap/newgidmap exist and are setuid.
Use fuse-overlayfs for rootless storage instead of native overlay.