Using plugin-buildah on OpenShift/MicroShift: `Error during unshare(CLONE_NEWUSER): Function not implemented`

[kastl-ars]

Dear maintainers,

I am currently fooling around with Woodpecker on OpenShift/MicroShift, which is a little tricky due to the security restrictions in place (SCC, ...).

I got the clone step working by setting the proper unprivileged user, but the plugin-buildah step fails in my setup.

INF plugin-buildah - version "devel"-"5a51e79"
INF using "docker.io" as the default search registry
WRN username was not set!
WRN password was not set!
INF build command: buildah build --registries-conf=/tmp/registries.conf --retry=1 -f=Containerfile --authfile=/tmp/auths.json -t=quay.io/kastl-atvantage/build-container-image-with-woodpecker:buildah .
time="2026-08-05T09:10:37Z" level=warning msg="Reading allowed ID mappings: reading subuid mappings for user \"1000270000\" and subgid mappings for group \"1000270000\": no subuid ranges found for user \"1000270000\" in /etc/subuid"
time="2026-08-05T09:10:37Z" level=warning msg="Found no UID ranges set aside for user \"1000270000\" in /etc/subuid."
time="2026-08-05T09:10:37Z" level=warning msg="Found no GID ranges set aside for user \"1000270000\" in /etc/subgid."
Error during unshare(CLONE_NEWUSER): Function not implemented
time="2026-08-05T09:10:37Z" level=error msg="parsing PID \"\": strconv.Atoi: parsing \"\": invalid syntax"
time="2026-08-05T09:10:37Z" level=error msg="(Unable to determine exit status)"
ERR execution failed error="failed to build image: exit status 1"

The interesting part seems to be this one: Error during unshare(CLONE_NEWUSER): Function not implemented

My workflow step looks like this, if I read the documentation properly this should build in a non-privileged way (pushing is currently disabled to be able to test this first).

  - name: build-with-buildah
    image: ghcr.io/404systems/plugin-buildah
    backend_options:
[...]
    settings:
      registry: quay.io
      repo: kastl-atvantage/build-container-image-with-woodpecker
      tags: buildah
      skip_push: true
      containerfile: Containerfile
      environment:
        STORAGE_DRIVER: vfs
        BUILDAH_ISOLATION: chroot

I also tested with BUILDAH_ISOLATION: rootless, but same error.

The actual Pod object in OpenShift drops all capabilities and has the runAsNonRoot flag set to true. runAsUser etc. are set to the correct non-root UID for this OpenShift namespace (otherwise the pod would not be allowed to start).

spec: 
  containers:
[...]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
[...]
  securityContext:
    fsGroup: 1000270000
    runAsGroup: 1000270000
    runAsUser: 1000270000
    seLinuxOptions:
      level: s0:c16,c15
    seccompProfile:
      type: RuntimeDefault
[...]

Any idea how to get this working?

Kind Regards,
Johannes

[kastl-ars]

After running oc adm policy add-scc-to-user -n woodpecker-agent-unrestricted -z default anyuid (which allows the default serviceAccount to use the anyuid SCC, the build proceeds a little further, but still fails.

Getting image source signatures
Copying blob sha256:c91c5965243d22d21a60d5302987ce3c6ba18520dcb62af901ac44f76877f9d3
Copying blob sha256:2b7a6c75c4da2211b872f41f32a9c3b8927f8d1e2fc14f870eb49b1e59121b48
Error: creating build container: unable to copy from source docker://registry.suse.com/suse/nginx:1.27: copying system image from manifest list: writing blob: adding layer with blob "sha256:2b7a6c75c4da2211b872f41f32a9c3b8927f8d1e2fc14f870eb49b1e59121b48"/""/"sha256:634b5db52dad486f9a4aede23f6fe43745fca204efae15f85d2facf7f465367a": unpacking failed (error: exit status 1; output: potentially insufficient UIDs or GIDs available in user namespace (requested 0:15 for /etc/shadow): Check /etc/subuid and /etc/subgid if configured locally and run "podman system migrate": lchown /etc/shadow: invalid argument)
ERR execution failed error="failed to build image: exit status 1"