Excessive warning when run as rootless (`Hint: enable cgroup v2 delegation` is printed even when it is already enabled)

[ricardobranco777]

Description

Excessive warning when run as rootless

Steps to reproduce the issue

From the automated BATS testsuite:

WARNING: The bats command will remove all existing containers & images.

1. Install bats
2. git clone --depth 1 https://github.com/containers/podman
3. cd podman/test/system
4. PODMAN=/usr/bin/podman QUADLET=/usr/libexec/podman/quadletbats -t 195-run-namespaces.bats

Describe the results you received and expected

Expected:
pid:\[4026532491\]

Received:

pid:[4026532491]
# time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"

Full commands:

# [06:24:42.454494507] $ /usr/bin/podman run --name c-cgroup-t359-8qf994tn --cgroupns private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/cgroup; sleep inf
# [06:24:42.664840627] 80ed1b81112e595e6e19590d7aab4216d286174a4e5ed437ef8cb1e5c2d5ff73
#
# [06:24:42.670640534] $ /usr/bin/podman run --rm --cgroupns container:c-cgroup-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/cgroup
# [06:24:42.985568894] cgroup:[4026532492]
#
# [06:24:42.996644307] $ /usr/bin/podman logs c-cgroup-t359-8qf994tn
# [06:24:43.046330438] cgroup:[4026532492]
#
# [06:24:43.059614118] $ /usr/bin/podman rm -f -t0 c-cgroup-t359-8qf994tn
# [06:24:43.284763404] c-cgroup-t359-8qf994tn
#
# [06:24:43.296239483] $ /usr/bin/podman run --name c-ipc-t359-8qf994tn --ipc shareable -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/ipc; sleep inf
# [06:24:43.497113256] 1f0eeeff57673dabcd162a7f92b3e45a93f9f423268dd757fff468518922ad58
#
# [06:24:43.503286819] $ /usr/bin/podman run --rm --ipc container:c-ipc-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/ipc
# [06:24:43.815077757] ipc:[4026532490]
#
# [06:24:43.825436117] $ /usr/bin/podman logs c-ipc-t359-8qf994tn
# [06:24:43.888895038] ipc:[4026532490]
#
# [06:24:43.902312689] $ /usr/bin/podman rm -f -t0 c-ipc-t359-8qf994tn
# [06:24:44.103551710] c-ipc-t359-8qf994tn
#
# [06:24:44.115515517] $ /usr/bin/podman run --name c-net-t359-8qf994tn --network private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/net; sleep inf
# [06:24:44.300356125] 0e678cbdf7f7c6f71748fbda4b82fd92bf4b368f38cccb7670334439319e1b00
#
# [06:24:44.306870863] $ /usr/bin/podman run --rm --network container:c-net-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/net
# [06:24:44.631963661] net:[4026532412]
#
# [06:24:44.644109702] $ /usr/bin/podman logs c-net-t359-8qf994tn
# [06:24:44.702946435] net:[4026532412]
#
# [06:24:44.717406455] $ /usr/bin/podman rm -f -t0 c-net-t359-8qf994tn
# [06:24:44.932304778] c-net-t359-8qf994tn
#
# [06:24:44.942977974] $ /usr/bin/podman run --name c-pid-t359-8qf994tn --pid private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/pid; sleep inf
# [06:24:45.138506420] 1a0f7be22e5c02a34f0777e33179fa80a6e05352febecd04982aa379ac1d9810
#
# [06:24:45.145252051] $ /usr/bin/podman run --rm --pid container:c-pid-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/pid
# [06:24:45.471202035] pid:[4026532491]
# time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"
#
# [06:24:45.482752827] $ /usr/bin/podman logs c-pid-t359-8qf994tn
# [06:24:45.546485301] pid:[4026532491]
# #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
# #|     FAIL: (pid) namespace matches (type: private)
# #| expected: pid:\[4026532491\]
# #|         > time=\"2025-04-16T06:24:45-04:00\" level=warning msg=\"failed to kill all processes\, possibly due to lack of cgroup \(Hint: enable cgroup v2 delegation\)\" error=\"cgroup not exist\"
# #|   actual: pid:\[4026532491\]
# #\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

What version of runc are you using?

runc version 1.2.6
commit: v1.2.6-0-ge89a29929c77
spec: 1.2.0
go: go1.24.2
libseccomp: 2.6.0

Host OS information

NAME="openSUSE Tumbleweed"
# VERSION="20250414"
ID="opensuse-tumbleweed"
ID_LIKE="opensuse suse"
VERSION_ID="20250414"
PRETTY_NAME="openSUSE Tumbleweed"
ANSI_COLOR="0;32"
# CPE 2.3 format, boo#1217921
CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20250414:*:*:*:*:*:*:*"
#CPE 2.2 format
#CPE_NAME="cpe:/o:opensuse:tumbleweed:20250414"
BUG_REPORT_URL="https://bugzilla.opensuse.org"
SUPPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
LOGO="distributor-logo-Tumbleweed"

Host kernel information

Linux opensuse 6.14.1-1-default #1 SMP PREEMPT_DYNAMIC Mon Apr 7 08:22:06 UTC 2025 (ca98696) x86_64 x86_64 x86_64 GNU/Linux

[lifubang]

> # [06:24:45.145252051] $ /usr/bin/podman run --rm --pid container:c-pid-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/pid
> # [06:24:45.471202035] pid:[4026532491]
> # time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"
> #

So this is an example of start a rootless container with a shared pid namespace of the host, we wanted to abandon this type container, but we decided to just print a warn message by considering the backward compatibility, for more informations, please see:
#4395 (comment)
#4395 (review)

If you have a way to kill all processes in this type container, feel free to let us know.

[ricardobranco777]

So this is an example of start a rootless container with a shared pid namespace of the host, we wanted to abandon this type container, but we decided to just print a warn message by considering the backward compatibility, for more informations, please see: #4395 (comment) #4395 (review)

If you have a way to kill all processes in this type container, feel free to let us know.

The problem is that the warning is misleading: the cgroup exists & cgroups v2 delegation is enabled.

[ricardobranco777]

I haven't seen the issue with runc 1.3.0 so it can be closed.

[Darex2094]

Running runc-1.3.0-1.1 and encountering the problem.

Information for package runc:
-----------------------------
Repository     : Main Repository (OSS)
Name           : runc
Version        : 1.3.0-1.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 12.1 MiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : runc-1.3.0-1.1.src
Upstream URL   : https://github.com/opencontainers/runc
Summary        : Tool for spawning and running OCI containers
Description    : 
    runc is a CLI tool for spawning and running containers according to the OCI
    specification. It is designed to be as minimal as possible, and is the
    workhorse
    of Docker. It was originally designed to be a replacement for LXC within
    Docker,
    and has grown to become a separate project entirely.

:~> distrobox stop <container>
WARN[0000] failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)  error="cgroup not exist"

:~> [ -f /sys/fs/cgroup/cgroup.controllers ] && echo "cgroups v2 enabled"
cgroups v2 enabled

:~> mount | grep cgroup2
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,seclabel,nsdelegate,memory_recursiveprot)

[bcarnazzi]

Running runc-1.3.0-1.1 and encountering the problem.

Information for package runc:
-----------------------------
Repository     : Main Repository (OSS)
Name           : runc
Version        : 1.3.0-1.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 12.1 MiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : runc-1.3.0-1.1.src
Upstream URL   : https://github.com/opencontainers/runc
Summary        : Tool for spawning and running OCI containers
Description    : 
    runc is a CLI tool for spawning and running containers according to the OCI
    specification. It is designed to be as minimal as possible, and is the
    workhorse
    of Docker. It was originally designed to be a replacement for LXC within
    Docker,
    and has grown to become a separate project entirely.

:~> distrobox stop <container>
WARN[0000] failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)  error="cgroup not exist"

:~> [ -f /sys/fs/cgroup/cgroup.controllers ] && echo "cgroups v2 enabled"
cgroups v2 enabled

:~> mount | grep cgroup2
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,seclabel,nsdelegate,memory_recursiveprot)

same error on 1.3.3 with podman/distrobox:

Nom                      : runc
Version                  : 1.3.3-1
Description              : CLI tool for managing OCI compliant containers
Architecture             : x86_64
URL                      : https://runc.io/
Licences                 : Apache
Groupes                  : --
Fournit                  : oci-runtime
Dépend de                : libseccomp
Dépendances opt.         : criu: checkpoint support
Requis par               : podman
Optionnel pour           : --
Est en conflit avec      : --
Remplace                 : --
Taille installée         : 10,37 MiB
Paqueteur                : Frederik Schwan <freswa@archlinux.org>
Compilé le               : mer. 05 nov. 2025 19:15:52
Installé le              : sam. 08 nov. 2025 17:55:32
Motif d’installation     : Installé comme dépendance d’un autre paquet
Script d’installation    : Non
Validé par               : Signature

[kolyshkin]

@theotherJohnC @bcarnazzi I am unable to reproduce it on my Fedora 43 box; here are the steps I tried:

[kir@kir-tp1 runc]$ rpm -q runc distrobox podman
runc-1.3.2-1.fc43.x86_64
distrobox-1.8.2.0-1.fc43.noarch
podman-5.6.2-1.fc43.x86_64

[kir@kir-tp1 runc]$ distrobox create -n test
Creating 'test' using image registry.fedoraproject.org/fedora-toolbox:latest	 [ OK ]
Distrobox 'test' successfully created.
To enter, run:

distrobox enter test

[kir@kir-tp1 runc]$ distrobox stop test
Do you really want to stop test? [Y/n]: y
test

[kir@kir-tp1 runc]$ distrobox rm test
Do you really want to delete containers: test? [Y/n]: y
Removing container...
test
Removing exported binaries...

Please provide specific steps needed to reproduce this. Also, see #4732 (comment) above.

[ricardobranco777]

Closing this one as daily testing reveals it only happens with older versions of runc v1.2.x