buildah potentially insufficient UIDs or GIDs available in user namespace

[manas-suleman]

Hi,

I have deployed the controller on OKD4.15. I'm trying to build an image using buildah with a Dockerfile within the runner but getting the following warnings and error when trying to pull the base image specified within Dockerfile.

WARN[0000] error running newgidmap: exit status 1: newgidmap: write to gid_map failed: Operation not permitted
WARN[0000] falling back to single mapping
WARN[0000] error running newuidmap: exit status 1: newuidmap: write to uid_map failed: Operation not permitted
WARN[0000] falling back to single mapping
[1/3] STEP 1/7: FROM ubuntu:22.04 AS base
error creating build container: writing blob: adding layer with blob "sha256:7646c8da332499ae416b15479ce832db32e39a501c662e24324f595509a0d3db": Error processing tar file(exit status 1): potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow): Check /etc/subuid and /etc/subgid: lchown /etc/gshadow: invalid argument
ERRO[0004] exit status 125

In order to rule out this being an issue with the controller installation (since OKD/OpenShift isn't supported), I ran the runner image ghcr.io/actions/actions-runner:latest outside of OKD and then tried building the image inside it but still got the same issues. I've also tried running the runner container and the build command buildah build . with sudo with no change in errors.

I think there's some particular setting or a package missing from the runner container that's causing the issue but haven't been able to figure it out.

Details within ghcr.io/actions/actions-runner:latest image:
id

uid=1001(runner) gid=1001(runner) groups=1001(runner),27(sudo),123(docker)

buildah unshare cat /proc/self/uid_map

WARN[0000] error running newgidmap: exit status 1: newgidmap: write to gid_map failed: Operation not permitted
WARN[0000] falling back to single mapping
WARN[0000] error running newuidmap: exit status 1: newuidmap: write to uid_map failed: Operation not permitted
WARN[0000] falling back to single mapping
         0       1001          1

buildah info

{
    "host": {
        "CgroupVersion": "v1",
        "Distribution": {
            "distribution": "ubuntu",
            "version": "22.04"
        },
        "MemFree": 306552832,
        "MemTotal": 8025604096,
        "OCIRuntime": "crun",
        "SwapFree": 3330596864,
        "SwapTotal": 3439325184,
        "arch": "amd64",
        "cpus": 4,
        "hostname": "7fcd04568411",
        "kernel": "4.18.0-513.24.1.el8_9.x86_64",
        "os": "linux",
        "rootless": true,
        "uptime": "1076h 23m 59.88s (Approximately 44.83 days)"
    },
    "store": {
        "ContainerStore": {
            "number": 0
        },
        "GraphDriverName": "overlay",
        "GraphOptions": [
            "overlay.mount_program=/usr/bin/fuse-overlayfs"
        ],
        "GraphRoot": "/home/runner/.local/share/containers/storage",
        "GraphStatus": {
            "Backing Filesystem": "overlayfs",
            "Native Overlay Diff": "false",
            "Supports d_type": "true",
            "Using metacopy": "false"
        },
        "ImageStore": {
            "number": 0
        },
        "RunRoot": "/var/tmp/containers-user-1001/containers"
    }
}

cat /etc/subuid ; cat /etc/subgid

runner:100000:65536
runner:100000:65536

apt info libvshadow-utils

Package: libvshadow-utils
Version: 20190323-2build1
Priority: optional
Section: universe/otherosfs
Source: libvshadow
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 140 kB
Depends: libbfio1 (>= 20120425), libc6 (>= 2.34), libfuse2 (>= 2.6), libvshadow1 (>= 20160110)
Homepage: https://github.com/libyal/libvshadow
Download-Size: 34.8 kB
APT-Manual-Installed: yes
APT-Sources: http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
Description: Volume Shadow Snapshot format access library -- Utilities

sudo getcap /usr/bin/newuidmap /usr/bin/newgidmap

sudo: unable to send audit message: Operation not permitted

Really appreciate any suggestions I can get.

Thanks,

[manas-suleman]

fixed it by using the dind runner image and building with docker, closing this