# Fixing Podman Build Newuidmap Errors on WSL2 Arch Linux


When running rootless Podman inside Arch Linux on WSL2, an image build may fail before it even starts processing the Dockerfile:

```bash
podman build . -t game-crawler:latest
```

The error looks like this:

```text
WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
ERRO[0000] running `/usr/sbin/newuidmap 61029 0 1000 1 1 100000 65536`: newuidmap: Could not set caps
Error: cannot set up namespace using "/usr/sbin/newuidmap": should have setuid or have filecaps setuid: exit status 1
```

The `"/" is not a shared mount` line is only a warning. The build fails because of `newuidmap: Could not set caps`.

## When this happens

This is a rootless Podman setup problem, not a Dockerfile problem.

Podman's official [rootless tutorial](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md) explains that rootless Podman needs subordinate UID/GID ranges in `/etc/subuid` and `/etc/subgid`. The `newuidmap(1)` manual says that `newuidmap` sets the UID mapping of a user namespace and checks whether the caller is allowed to use those ranges through `/etc/subuid`.

Rootless Podman therefore needs these helper binaries when creating the container namespace:

```text
/usr/bin/newuidmap
/usr/bin/newgidmap
```

On Arch Linux, they come from the `shadow` package. If they have neither the setuid bit nor the required file capabilities, an unprivileged user cannot complete the UID/GID mapping step, and `podman build` fails while setting up the namespace.

## Check the current state

Check permissions and file capabilities first:

```bash
stat -c '%A %U:%G %a %n' /usr/bin/newuidmap /usr/bin/newgidmap
getcap /usr/bin/newuidmap /usr/bin/newgidmap
```

A broken setup may look like this:

```text
-rwxr-xr-x root:root 755 /usr/bin/newuidmap
-rwxr-xr-x root:root 755 /usr/bin/newgidmap
```

`getcap` prints nothing.

Then check whether the current user has subordinate IDs:

```bash
grep "^$USER:" /etc/subuid /etc/subgid
```

A valid setup has entries like these:

```text
/etc/subuid:nite:100000:65536
/etc/subgid:nite:100000:65536
```

If the user has no entries there, add the subordinate ID ranges first. If the entries already exist and `newuidmap/newgidmap` still have no setuid bit or file capabilities, fix the helper permissions.

## Fix it with file capabilities

Give each helper the minimal capability it needs:

```bash
sudo setcap cap_setuid=ep /usr/bin/newuidmap
sudo setcap cap_setgid=ep /usr/bin/newgidmap
```

Verify it:

```bash
getcap /usr/bin/newuidmap /usr/bin/newgidmap
```

Expected output:

```text
/usr/bin/newuidmap cap_setuid=ep
/usr/bin/newgidmap cap_setgid=ep
```

On Arch Linux, `/usr/sbin` is usually a symlink to `bin`, so an error mentioning `/usr/sbin/newuidmap` is still fixed by changing `/usr/bin/newuidmap`.

## Verify the rootless namespace

There is no need to run a full image build just to test the fix. Use `podman unshare` first:

```bash
podman unshare sh -c 'echo uid_map:; cat /proc/self/uid_map; echo gid_map:; cat /proc/self/gid_map'
```

After the fix, the output should look like this:

```text
uid_map:
         0       1000          1
         1     100000      65536
gid_map:
         0       1000          1
         1     100000      65536
```

Here `1000` is the WSL user's UID, and `100000 65536` comes from `/etc/subuid` and `/etc/subgid`.

Then retry the build:

```bash
podman build . -t game-crawler:latest
```

## If setcap is missing

Check whether `setcap/getcap` are installed:

```bash
command -v setcap getcap
```

If not, install the package that provides them:

```bash
sudo pacman -S libcap
```

The traditional fallback is to set the setuid bit on both helpers:

```bash
sudo chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap
```

Check it with:

```bash
stat -c '%A %U:%G %n' /usr/bin/newuidmap /usr/bin/newgidmap
```

The mode should show `-rwsr-xr-x`. If file capabilities work, prefer `setcap` because it grants a narrower privilege.


---

> Author: Nite  
> URL: https://www.nite07.com/en/posts/wsl-rootless-podman-newuidmap/