Molecule podman rootless "cannot setup namespace" in CI

Rootless podman needs user-namespace maps (/etc/subuid and /etc/subgid) and the newuidmap/newgidmap setuid helpers. On a minimal CI container these are often missing, so podman cannot create the instance.

What this error means

Molecule create with the podman driver fails with "cannot setup namespace using \"/usr/bin/newuidmap\"" or "no subuid ranges found for user".

Error: cannot setup namespace using "/usr/bin/newuidmap":
exit status 1: newuidmap: write to uid_map failed: Operation not permitted

Common causes

Missing subuid/subgid ranges for the CI user

Rootless podman maps container UIDs to a range in /etc/subuid and /etc/subgid. A CI user without a range cannot start a rootless container.

newuidmap/newgidmap helpers absent or not setuid

The uidmap package provides newuidmap/newgidmap; if missing or lacking the setuid bit, podman cannot set up the namespace.

How to fix it

Provision subuid/subgid and uidmap

1. Install the uidmap package so the setuid helpers exist.
2. Add a subuid/subgid range for the CI user.
3. Re-run Molecule with the podman driver.

sudo apt-get update && sudo apt-get install -y uidmap
sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 "$USER"

Use the docker driver where rootless podman is not viable

If the runner cannot support rootless namespaces, switch the scenario to the docker driver instead.

driver:
  name: docker

How to prevent it

• Bake uidmap and subuid/subgid ranges into custom runner images.
• Prefer the docker driver on runners without rootless support.
• Test the podman scenario on the same image CI uses.

Related guides