Rootless subuid/subgid setup for daemonless builds in CI
Rootless builders map the container UID range onto host subordinate IDs defined in /etc/subuid and /etc/subgid. If the range is missing or too small (fewer than the 65536 IDs a typical image uses), the build fails when it cannot map a UID an instruction needs.
What this error means
A rootless build fails with "there might not be enough IDs available in the namespace (requested X:Y for /some/path)" or "lchown ...: invalid argument" during a COPY or unpack.
Error: writing blob: adding layer with blob "sha256:...":
there might not be enough IDs available in the namespace (requested 1000:1000 for /home):
lchown /home: invalid argumentCommon causes
The subuid/subgid range is too small
An image that uses a high UID needs a range large enough to cover it; a short range cannot map that UID and the chown fails.
No subuid/subgid entry for the build user at all
With no subordinate ID range configured, the builder cannot create the user namespace mapping at all.
How to fix it
Grant a full 65536 ID range
Give the build user a standard-sized range in both files so any image UID can be mapped.
echo "build:100000:65536" >> /etc/subuid
echo "build:100000:65536" >> /etc/subgidRefresh cached mappings after changing the range
For podman, reset rootless state so the new ranges take effect.
podman system migrateHow to prevent it
- Provision a 65536-wide subuid/subgid range for the build user.
- Bake these ranges into the CI image rather than editing at job time.
- Run podman system migrate after changing rootless ID ranges.