Describe the bug
Running podman build inside a Che workspace fails for any Dockerfile that uses apt-get (Debian/Ubuntu-based images). The apt package manager drops privileges to UID 65534 (nobody) for sandboxing, but UDI's /etc/subuid maps only 64535 UIDs (user:1001:64535), so UID 65534 falls outside the mapped range.
Steps to reproduce
- Open Eclipse Che dashboard
- Create a workspace from https://github.com/coder/envbuilder-starter-devcontainer
- Open a terminal in the workspace
- Run:
podman build -f .devcontainer/Dockerfile .
Observed behavior
STEP 2/6: RUN apt-get update
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)
subprocess exited with status 100
Error: building at STEP "RUN apt-get update": exit status 100
Expected behavior
podman build should succeed for Debian/Ubuntu-based Dockerfiles inside a Che workspace.
Root cause
- UDI ships
/etc/subuid with user:1001:64535 — maps UIDs 0 through 64535
apt drops to UID 65534 (nobody) for sandbox operations, which is outside this range
- The kernel's outer uid_map caps total mappable UIDs at 65536
- Since podman's first mapping uses 1 UID (
0 1000 1), the second can only go up to 65535 — so the subuid range cannot simply be widened to cover UID 65534
Che version
Latest (tested August 2026)
Environment
- OpenShift cluster
- UDI:
quay.io/devfile/universal-developer-image:ubi9-latest
- Podman 5.6.0, rootless, overlay storage
- SCC:
container-run
Describe the bug
Running
podman buildinside a Che workspace fails for any Dockerfile that usesapt-get(Debian/Ubuntu-based images). Theaptpackage manager drops privileges to UID 65534 (nobody) for sandboxing, but UDI's/etc/subuidmaps only 64535 UIDs (user:1001:64535), so UID 65534 falls outside the mapped range.Steps to reproduce
podman build -f .devcontainer/Dockerfile .Observed behavior
Expected behavior
podman buildshould succeed for Debian/Ubuntu-based Dockerfiles inside a Che workspace.Root cause
/etc/subuidwithuser:1001:64535— maps UIDs 0 through 64535aptdrops to UID 65534 (nobody) for sandbox operations, which is outside this range0 1000 1), the second can only go up to 65535 — so the subuid range cannot simply be widened to cover UID 65534Che version
Latest (tested August 2026)
Environment
quay.io/devfile/universal-developer-image:ubi9-latestcontainer-run