[GH-ISSUE #477] Rootless Podman: app containers fail with "device cgroup rules are not supported in rootless mode" #287

New issue

Closed

opened 2026-10-15 12:59:21 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 12:59:21 +00:00

Owner

Originally created by @sturq on GitHub (Aug 16, 2026).
Original GitHub issue: https://github.com/games-on-whales/wolf/issues/477

Wolf itself starts fine under rootless Podman, but launching any app fails because the app container is created with a device cgroup rule, which rootless Podman cannot support.

What happens

Wolf runs, pairing works, the Wayland compositor comes up and the GStreamer pipeline starts. As soon as an app is launched (tested with "Test ball" and Wolf UI), the runner aborts:

[DOCKER] error 500 - {"cause":"device cgroup rules are not supported in rootless mode or in a user namespace",
"message":"container create: device cgroup rules are not supported in rootless mode or in a user namespace","response":500}

This is a hard limitation of rootless Podman rather than a configuration problem: device cgroup rules require privileges that a rootless user namespace does not have.

For the Wolf container itself the rule can simply be omitted (the devices are passed with --device instead) and Wolf starts normally. But the rule Wolf applies to the app containers it creates is not configurable, so there is no way to work around it from the outside.

Steps to reproduce

Run Wolf rootless with the Podman socket mounted as /var/run/docker.sock, devices passed via --device /dev/dri --device /dev/uinput --device /dev/uhid, and no --device-cgroup-rule (that flag is rejected outright in rootless mode).
Pair a Moonlight client (works).
Launch any app.
The runner aborts with the error above.

Other rootless-specific findings

Two more issues showed up before reaching the cgroup error, both solvable, noting them in case they are useful:

Unable to find docker mount for path: ... — Wolf resolves its own container mounts to host paths via the Docker API. When XDG_RUNTIME_DIR points at a path that is not an explicit bind mount, the lookup fails. Mounting that path explicitly (e.g. -v /host/sockets:/tmp/sockets with XDG_RUNTIME_DIR=/tmp/sockets) resolves it.
Failed to create mouse/keyboard: Permission denied — /dev/uinput is root:input 0660 on the host, but the input group is not mapped into the rootless user namespace, so it appears as nobody:nogroup inside the container. --userns=keep-id is not a workaround here: the image's startup script needs to chmod files it does not own in that mode and exits with chmod: changing permissions of '/opt/gow/startup.sh': Operation not permitted.

Question

Is rootless Podman intended to be supported? The docs mention Podman support and there are references to rootless patches, but the device cgroup rule on app containers appears to block it entirely. If the rule could be made optional (e.g. skipped when the runtime reports rootless, since the devices are already passed explicitly), rootless deployments would work.

Environment

AlmaLinux 10.2, kernel 6.12.0-211.el10_2, SELinux enforcing
Podman 5.8.2, rootless, Quadlet-managed, dedicated unprivileged service user with linger
Wolf stable (revision 7f416ec0f2)
AMD RX 7900 XT (gfx1100) via VAAPI, second AMD GPU present, WOLF_RENDER_NODE set explicitly

Running Wolf rootful works as expected.

Originally created by @sturq on GitHub (Aug 16, 2026). Original GitHub issue: https://github.com/games-on-whales/wolf/issues/477 Wolf itself starts fine under rootless Podman, but launching any app fails because the app container is created with a device cgroup rule, which rootless Podman cannot support. ## What happens Wolf runs, pairing works, the Wayland compositor comes up and the GStreamer pipeline starts. As soon as an app is launched (tested with "Test ball" and Wolf UI), the runner aborts: ``` [DOCKER] error 500 - {"cause":"device cgroup rules are not supported in rootless mode or in a user namespace", "message":"container create: device cgroup rules are not supported in rootless mode or in a user namespace","response":500} ``` This is a hard limitation of rootless Podman rather than a configuration problem: device cgroup rules require privileges that a rootless user namespace does not have. For the Wolf container itself the rule can simply be omitted (the devices are passed with `--device` instead) and Wolf starts normally. But the rule Wolf applies to the app containers it creates is not configurable, so there is no way to work around it from the outside. ## Steps to reproduce 1. Run Wolf rootless with the Podman socket mounted as `/var/run/docker.sock`, devices passed via `--device /dev/dri --device /dev/uinput --device /dev/uhid`, and no `--device-cgroup-rule` (that flag is rejected outright in rootless mode). 2. Pair a Moonlight client (works). 3. Launch any app. 4. The runner aborts with the error above. ## Other rootless-specific findings Two more issues showed up before reaching the cgroup error, both solvable, noting them in case they are useful: - `Unable to find docker mount for path: ...` — Wolf resolves its own container mounts to host paths via the Docker API. When `XDG_RUNTIME_DIR` points at a path that is not an explicit bind mount, the lookup fails. Mounting that path explicitly (e.g. `-v /host/sockets:/tmp/sockets` with `XDG_RUNTIME_DIR=/tmp/sockets`) resolves it. - `Failed to create mouse/keyboard: Permission denied` — `/dev/uinput` is `root:input 0660` on the host, but the `input` group is not mapped into the rootless user namespace, so it appears as `nobody:nogroup` inside the container. `--userns=keep-id` is not a workaround here: the image's startup script needs to chmod files it does not own in that mode and exits with `chmod: changing permissions of '/opt/gow/startup.sh': Operation not permitted`. ## Question Is rootless Podman intended to be supported? The docs mention Podman support and there are references to rootless patches, but the device cgroup rule on app containers appears to block it entirely. If the rule could be made optional (e.g. skipped when the runtime reports rootless, since the devices are already passed explicitly), rootless deployments would work. ## Environment - AlmaLinux 10.2, kernel 6.12.0-211.el10_2, SELinux enforcing - Podman 5.8.2, rootless, Quadlet-managed, dedicated unprivileged service user with linger - Wolf `stable` (revision 7f416ec0f26bb4d95218af806cd1181fe5434598) - AMD RX 7900 XT (gfx1100) via VAAPI, second AMD GPU present, `WOLF_RENDER_NODE` set explicitly Running Wolf rootful works as expected.

bsakaguchi closed this issue

2026-10-15 12:59:21 +00:00

bsakaguchi commented

2026-10-15 12:59:22 +00:00

Author

Owner

@r0b0tb4c0n commented on GitHub (Sep 18, 2026):

you can assign cgroup permissions to your user slice if you use cgroups v2. look here for a pretty good overview:
https://oneuptime.com/blog/post/2026-03-18-use-cgroups-v2-rootless-podman/view

@r0b0tb4c0n commented on GitHub (Sep 18, 2026): you can assign cgroup permissions to your user slice if you use cgroups v2. look here for a pretty good overview: https://oneuptime.com/blog/post/2026-03-18-use-cgroups-v2-rootless-podman/view

bsakaguchi commented

2026-10-15 12:59:22 +00:00

Author

Owner

@ABeltramo commented on GitHub (Sep 21, 2026):

Closing this assuming that the comment from @r0b0tb4c0n fixes it, feel free to re-open if that's not the case.

@ABeltramo commented on GitHub (Sep 21, 2026): Closing this assuming that the comment from @r0b0tb4c0n fixes it, feel free to re-open if that's not the case.

bsakaguchi referenced this issue

2026-10-15 13:00:18 +00:00

[PR #287] [MERGED] fix: get CUDA device index in ascending order based on PCI addresses #402