From 1b23172d8a0ea63f3d82edb900f65d1c84b786a6 Mon Sep 17 00:00:00 2001 From: Timothy Day Date: Sat, 25 Jul 2026 11:44:36 -0400 Subject: [PATCH] storage/overlay: use userxattr when probing idmapped lower layers supportsIdmappedLowerLayers() performs a test overlay mount to detect whether the kernel supports idmapped lower layers. When running rootless, the kernel requires the userxattr mount option for unprivileged overlay mounts, so the probe mount always failed and rootless podman incorrectly reported idmapped mounts as unsupported. Pass userxattr in the probe mount options when running rootless, so the check reflects actual kernel support. Fixes: 9eb030e97af9 ("overlay: use idmapped lower layers where supported") Signed-off-by: Timothy Day --- storage/drivers/overlay/check.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/storage/drivers/overlay/check.go b/storage/drivers/overlay/check.go index bd77ca019d..099fd52ec4 100644 --- a/storage/drivers/overlay/check.go +++ b/storage/drivers/overlay/check.go @@ -270,6 +270,9 @@ func supportsIdmappedLowerLayers(home string) (bool, error) { }() opts := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", lowerMappedDir, upperDir, workDir) + if unshare.IsRootless() { + opts += ",userxattr" + } flags := uintptr(0) if err := unix.Mount("overlay", mergedDir, "overlay", flags, opts); err != nil { return false, err