RHEL 10 – Rootless Podman Fails with Permission Denied in Storage – User Namespace Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Developers cannot run rootless containers, delaying CI/CD tasks.

Environment & Reproduction

Appears after home directory migration or UID mapping changes.

podman info
id

Root Cause Analysis

Incorrect ownership, missing subuid/subgid ranges, or SELinux context mismatch in storage path.

Quick Triage

Check user namespace mappings and storage path permissions.

grep $(whoami) /etc/subuid /etc/subgid
ls -ld ~/.local/share/containers

Step-by-Step Diagnosis

Inspect podman and audit logs for denied operations.

journalctl --user -u podman* -n 200 --no-pager
ausearch -m AVC -ts recent

Solution – Primary Fix

Reset ownership, ensure subid mappings, and restore contexts.

podman system reset -f
chown -R $(id -u):$(id -g) ~/.local/share/containers
restorecon -Rv ~/.local/share/containers

Solution – Alternative Approaches

Switch to an alternate rootless storage location with proper labels.

mkdir -p ~/podman-storage
vi ~/.config/containers/storage.conf

Verification & Acceptance Criteria

Rootless container runs and writes to volumes successfully.

podman run --rm registry.access.redhat.com/ubi10/ubi:latest echo ok

Rollback Plan

Restore previous storage.conf and container data backup if migration regresses.

cp ~/.config/containers/storage.conf.bak ~/.config/containers/storage.conf

Prevention & Hardening

Standardize rootless setup in user bootstrap scripts.

loginctl enable-linger $(whoami)
podman system migrate

Related Errors & Cross-Refs

permission denied, operation not permitted, cannot set up namespace.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Podman rootless guide and SELinux container labeling docs.