Fixing Podman Build Newuidmap Errors on WSL2 Arch Linux

When running rootless Podman inside Arch Linux on WSL2, an image build may fail before it even starts processing the Dockerfile:

podman build . -t game-crawler:latest

The error looks like this:

WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
ERRO[0000] running `/usr/sbin/newuidmap 61029 0 1000 1 1 100000 65536`: newuidmap: Could not set caps
Error: cannot set up namespace using "/usr/sbin/newuidmap": should have setuid or have filecaps setuid: exit status 1

The "/" is not a shared mount line is only a warning. The build fails because of newuidmap: Could not set caps.

When this happens

This is a rootless Podman setup problem, not a Dockerfile problem.

Podman’s official rootless tutorial explains that rootless Podman needs subordinate UID/GID ranges in /etc/subuid and /etc/subgid. The newuidmap(1) manual says that newuidmap sets the UID mapping of a user namespace and checks whether the caller is allowed to use those ranges through /etc/subuid.

Rootless Podman therefore needs these helper binaries when creating the container namespace:

/usr/bin/newuidmap
/usr/bin/newgidmap

On Arch Linux, they come from the shadow package. If they have neither the setuid bit nor the required file capabilities, an unprivileged user cannot complete the UID/GID mapping step, and podman build fails while setting up the namespace.

Check the current state

Check permissions and file capabilities first:

stat -c '%A %U:%G %a %n' /usr/bin/newuidmap /usr/bin/newgidmap
getcap /usr/bin/newuidmap /usr/bin/newgidmap

A broken setup may look like this:

-rwxr-xr-x root:root 755 /usr/bin/newuidmap
-rwxr-xr-x root:root 755 /usr/bin/newgidmap

getcap prints nothing.

Then check whether the current user has subordinate IDs:

grep "^$USER:" /etc/subuid /etc/subgid

A valid setup has entries like these:

/etc/subuid:nite:100000:65536
/etc/subgid:nite:100000:65536

If the user has no entries there, add the subordinate ID ranges first. If the entries already exist and newuidmap/newgidmap still have no setuid bit or file capabilities, fix the helper permissions.

Fix it with file capabilities

Give each helper the minimal capability it needs:

sudo setcap cap_setuid=ep /usr/bin/newuidmap
sudo setcap cap_setgid=ep /usr/bin/newgidmap

Verify it:

getcap /usr/bin/newuidmap /usr/bin/newgidmap

Expected output:

/usr/bin/newuidmap cap_setuid=ep
/usr/bin/newgidmap cap_setgid=ep

On Arch Linux, /usr/sbin is usually a symlink to bin, so an error mentioning /usr/sbin/newuidmap is still fixed by changing /usr/bin/newuidmap.

Verify the rootless namespace

There is no need to run a full image build just to test the fix. Use podman unshare first:

podman unshare sh -c 'echo uid_map:; cat /proc/self/uid_map; echo gid_map:; cat /proc/self/gid_map'

After the fix, the output should look like this:

uid_map:
         0       1000          1
         1     100000      65536
gid_map:
         0       1000          1
         1     100000      65536

Here 1000 is the WSL user’s UID, and 100000 65536 comes from /etc/subuid and /etc/subgid.

Then retry the build:

podman build . -t game-crawler:latest

If setcap is missing

Check whether setcap/getcap are installed:

command -v setcap getcap

If not, install the package that provides them:

sudo pacman -S libcap

The traditional fallback is to set the setuid bit on both helpers:

sudo chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap

Check it with:

stat -c '%A %U:%G %n' /usr/bin/newuidmap /usr/bin/newgidmap

The mode should show -rwsr-xr-x. If file capabilities work, prefer setcap because it grants a narrower privilege.