Cannot find mappings for user "containers": no subuid ranges found for user "containers"

[Iduoad]

I am migrating an application from Docker to Podman. In Docker, my application used the root Docker daemon with remaps for dockremap.

I ran containers as root from a privileged user, again relying on the rootful daemon. Thanks to dockremap, the containers ran in user namespaces, with UIDs and GIDs being remapped.

From some research, I understood that Podman handles things differently by supporting either completely rootless containers or DIY user-defined namespaces for rootful containers.

That was my understanding until I discovered this: when I set userns=auto in containers.conf, I started getting the following error:

Cannot find mappings for user "containers": no subuid ranges found for user "containers"

I don’t have any user named containers in my system. However, when I added remappings for containers in the subuid and subgid files, the containers started being created again with UID/GID mappings, in a manner very similar to Docker's behavior with dockremap.

Is this the same behavior we get from Docker with dockremap? Is the containers user in Podman equivalent to dockremap in Docker? If so, why doesn’t it appear in my /etc/passwd file?

[Iduoad]

Yes the containers user is similar to dockremap in docker.

Quoting the documentation:

The --userns=auto flag requires that the user name containers be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate. See subuid(5).
Example: containers:2147483647:2147483648.
Podman allocates unique ranges of UIDs and GIDs from the containers subordinate user ids. The size of the ranges is based on the number of UIDs required in the image. The number of UIDs and GIDs can be overridden with the size option.
The rootless option --userns=keep-id uses all the subuids and subgids of the user. Using --userns=auto when starting new containers will not work as long as any containers exist that were started with --userns=keep-id.