`failed to create 2048 locks in /libpod_lock` when using `--in-vm`

[goshansp]

Hey Team
Thanks for the amazing work you're doing. I have not been able to successfully create a .qcow2 from my OCI bootc image using --in-vm. With sudo I am able to generate the desired outcome. I have setenforce 0 so not hitting #2425

On Fedora 44 Silverblue I always get Error: failed to get new shm lock manager: failed to create 2048 locks in /libpod_lock: no such file or directory.

Any guidance will be highly appreciated. This is the last missing piece that would allow us to go fully rootless on our build chain.

Unrelated 1: My ultimate goal is to build an LVM based RHEL with Microshift. By using sudo this works flawlessly.
Unrelated 2: Also hitting another issue on RHEL9 described below

Reproduction Steps - failed to get new shm lock manager

podman run \
  --rm \
  -it \
  --privileged \
  --pull=newer \
  --security-opt label=type:unconfined_t \
  -v ./rhel-rootless/templates/config.qcow2.toml:/config.toml:ro \
  -v ./output:/output \
  -v ~/.local/share/containers/storage:/var/lib/containers/storage \
  quay.io/centos-bootc/bootc-image-builder:latest \
  --in-vm \
  --type qcow2 \
  --use-librepo=True \
  --rootfs ext4 \
  quay.io/fedora/fedora-bootc:latest
[\] Disk image building step
[4 / 5] Pipeline image [----------------------------------------------------------------------------------------------------------------------------------------------->____________________________________] 80.00%
[7 / 15] Stage org.osbuild.bootc.install-to-filesystem [--------------------------------------------------------------------->______________________________________________________________________________] 46.67%
Message: Finished pipeline image
2026/07/04 05:02:28 error: cannot run osbuild: error running osbuild: exit status 1
BuildLog:
starting -
Starting pipeline source org.osbuild.containers-storage
Finished module source org.osbuild.containers-storage
Finished pipeline org.osbuild.containers-storage
Starting pipeline build
Starting module org.osbuild.container-deploy
0a02f5ff0ee3a07c42c81c3dfafb687bfbc4b26292edbbb0e52d409953b4fcce
umount: /run/osbuild/containers/storage/overlay: not mounted.
WARNING: umount of overlay dir failed with an error: CompletedProcess(args=['umount', '-f', '--lazy', '/run/osbuild/containers/storage/overlay'], returncode=32)
Finished module org.osbuild.container-deploy
Starting module org.osbuild.selinux
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
Finished module org.osbuild.selinux
Finished pipeline build
Starting pipeline image
Starting module org.osbuild.truncate
Finished module org.osbuild.truncate
Starting module org.osbuild.sfdisk
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
label: gpt
label-id: 41c80ca6-0ca4-48da-857c-7be762cb121c
start="2048", size="2048", type="21686148-6449-6E6F-744E-656564454649", uuid="bdc1e2e6-300c-4f08-af7d-d7e1633b587e", bootable
start="4096", size="1026048", type="C12A7328-F81F-11D2-BA4B-00A0C93EC93B", uuid="50f1e43d-4ffb-4ee1-958d-bb52f3f54b6e"
start="1030144", size="2097152", type="0FC63DAF-8483-4772-8E79-3D69D8477DE4", uuid="f27d028f-3846-4dca-b7ee-1a5930e572cb"
start="3127296", size="17844191", type="0FC63DAF-8483-4772-8E79-3D69D8477DE4", uuid="16ea5126-52f8-4e11-ae42-58c2654bfedf"
{
   "partitiontable": {
      "label": "gpt",
      "id": "41C80CA6-0CA4-48DA-857C-7BE762CB121C",
      "device": "/dev/loop0",
      "unit": "sectors",
      "firstlba": 2048,
      "lastlba": 20971486,
      "sectorsize": 512,
      "partitions": [
         {
            "node": "/dev/loop0p1",
            "start": 2048,
            "size": 2048,
            "type": "21686148-6449-6E6F-744E-656564454649",
            "uuid": "BDC1E2E6-300C-4F08-AF7D-D7E1633B587E"
         },{
            "node": "/dev/loop0p2",
            "start": 4096,
            "size": 1026048,
            "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
            "uuid": "50F1E43D-4FFB-4EE1-958D-BB52F3F54B6E"
         },{
            "node": "/dev/loop0p3",
            "start": 1030144,
            "size": 2097152,
            "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
            "uuid": "F27D028F-3846-4DCA-B7EE-1A5930E572CB"
         },{
            "node": "/dev/loop0p4",
            "start": 3127296,
            "size": 17844191,
            "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
            "uuid": "16EA5126-52F8-4E11-AE42-58C2654BFEDF"
         }
      ]
   }
}
Finished module org.osbuild.sfdisk
Starting module org.osbuild.mkfs.fat
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mkfs.fat 4.2 (2021-01-31)
Finished module org.osbuild.mkfs.fat
Starting module org.osbuild.mkfs.ext4
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mke2fs 1.47.3 (8-Jul-2025)
Discarding device blocks:      0/262144
done
Creating filesystem with 262144 4k blocks and 65536 inodes
Filesystem UUID: abfc2b8d-bc01-4994-9f6b-93cbf0a3f3b4
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376

Allocating group tables: done
Writing inode tables: 0/8
done
Creating journal (8192 blocks):
done
Writing superblocks and filesystem accounting information:
0/8


done
Finished module org.osbuild.mkfs.ext4
Starting module org.osbuild.mkfs.ext4
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mke2fs 1.47.3 (8-Jul-2025)
Discarding device blocks:       0/2230523
done
Creating filesystem with 2230523 4k blocks and 558624 inodes
Filesystem UUID: dfec7258-383c-46a5-8e2d-9d23f9609223
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done 
Writing inode tables:  0/69
done
Creating journal (16384 blocks):
done
Writing superblocks and filesystem accounting information:  0/69

done
Finished module org.osbuild.mkfs.ext4
Starting module org.osbuild.bootc.install-to-filesystem
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p4 -> /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/
mount/boot (org.osbuild.ext4): mounting /dev/loop0p3 -> /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/boot
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p2 -> /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/boot/efi
Installing image: docker://quay.io/fedora/fedora-bootc:latest
Initializing ostree layout
error:
Installing to filesystem: Creating imgstorage: Initializing images: Subprocess failed: ExitStatus(unix_wait_status(32000))
time="2026-07-04T05:02:23Z" level=warning msg="Using cgroups-v1 which is deprecated in favor of cgroups-v2 with Podman v5 and will be removed in a future version. Set environment variable `PODMAN_IGNORE_CGROUPSV1_WARNING` to hide this warning."
Error: failed to get new shm lock manager: failed to create 2048 locks in /libpod_lock: no such file or directory
Traceback (most recent call last):
File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 89, in <module>
    r = main(args["options"], args["inputs"], args["paths"])
File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 82, in main
    subprocess.run(pargs, env=env, check=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.14/subprocess.py", line 578, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['bootc', 'install', 'to-filesystem', '--source-imgref', 'containers-storage:[overlay@/run/osbuild/containers/storage2+/run/containers/storage:additionalimagestore=/run/osbuild/containers/storage]0a02f5ff0ee3a07c42c81c3dfafb687bfbc4b26292edbbb0e52d409953b4fcce', '--skip-fetch-check', '--generic-image', '--karg', 'rw', '--karg', 'console=tty0', '--karg', 'console=ttyS0', '--target-imgref', 'quay.io/fedora/fedora-bootc:latest', '/run/osbuild/mounts']' returned non-zero exit status 1.
mount/boot-efi (org.osbuild.fat): umount: /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/boot/efi unmounted
mount/boot (org.osbuild.ext4): umount: /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/boot unmounted
mount/- (org.osbuild.ext4): umount: /run/osbuildvm/store/tmp/buildroot-tmp-piek_l3m/mounts/ unmounted
Finished module org.osbuild.bootc.install-to-filesystem
Finished pipeline image
manifest - failed
Output:
qemu-system-x86_64: terminating on signal 15 from pid 465 (/usr/bin/python3)
Failed

Podman info on Fedora 44 build host

 podman info
host:
  arch: amd64
  buildahVersion: 1.43.2
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc44.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 97.53
    systemPercent: 1.12
    userPercent: 1.35
  cpus: 24
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: silverblue
    version: "44"
  emulatedArchitectures:
  - linux/arm64
  - linux/arm64be
  eventLogger: journald
  freeLocks: 2039
  hostname: green.pamperspoil.com
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 7.0.14-201.fc44.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 9413197824
  memTotal: 33530843136
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-1.17.1-1.fc44.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.17.1
    package: netavark-1.17.2-1.fc44.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.17.2
  ociRuntime:
    name: crun
    package: crun-1.28-1.fc44.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.28
      commit: 54f16ffbefcd022bf032af768b5c5ce075c18bfc
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +JSON_C
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20260611.ga9c61ff-1.fc44.x86_64
    version: |
      pasta 0^20260611.ga9c61ff-1.fc44.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.1-4.fc44.x86_64
    version: |-
      slirp4netns version 1.3.1
      commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236
      libslirp: 4.9.1
      SLIRP_CONFIG_VERSION_MAX: 6
      libseccomp: 2.6.0
  swapFree: 8589824000
  swapTotal: 8589930496
  uptime: 9h 41m 10.00s (Approximately 0.38 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /var/home/hp/.config/containers/storage.conf
  containerStore:
    number: 3
    paused: 0
    running: 0
    stopped: 3
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/hp/.local/share/containers/storage
  graphRootAllocated: 1717986918400
  graphRootUsed: 1243674095616
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 3
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /var/home/hp/.local/share/containers/storage/volumes
version:
  APIVersion: 5.8.3
  BuildOrigin: Fedora Project
  Built: 1781222400
  BuiltTime: Fri Jun 12 02:00:00 2026
  GitCommit: 93dbfd0d86ee57f8f91801f61ce57dd880a4725f
  GoVersion: go1.26.4-X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 5.8.3

Succeeding Sudo Build For Reference

$ sudo podman run   --rm   -it   --privileged   --pull=newer   --security-opt label=type:unconfined_t   -v ./rhel-rootless/templates/config.qcow2.toml:/config.toml:ro   -v ./output:/output   -v /var/lib/containers/storage:/var/lib/containers/storage   quay.io/centos-bootc/bootc-image-builder:latest --type qcow2   --use-librepo=True   --rootfs ext4   quay.io/fedora/fedora-bootc:latest
[-] Disk image building step
[5 / 5] Pipeline qcow2 [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
[2 / 2] Stage org.osbuild.qemu [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
Message: Results saved in .

(Unrelated) RHEL9 Bootc - Setfiles Invalid Argument

Also unable to run same build command on RHEL9 with --in-vm and setenforce 0

$ podman run   --rm   -it   --privileged   --pull=newer   --security-opt label=type:unconfined_t   -v ./config.toml:/config.toml:ro   -v ./output:/output   -v ~/.local/share/containers/storage:/var/lib/containers/storage   quay.io/centos-bootc/bootc-image-builder:latest   --in-vm   --type qcow2   --use-librepo=True   --rootfs ext4   quay.io/fedora/fedora-bootc:latest
[-] Disk image building step
[3 / 5] Pipeline build [----------------------------------------------------------------------------------------------------------->________________________________________________________________________] 60.00%
[3 / 3] Stage org.osbuild.selinux [----------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
Message: Finished pipeline build
2026/07/04 05:23:01 error: cannot run osbuild: error running osbuild: exit status 1
BuildLog:
starting -
Starting pipeline source org.osbuild.containers-storage
Finished module source org.osbuild.containers-storage
Finished pipeline org.osbuild.containers-storage
Starting pipeline build
Starting module org.osbuild.container-deploy
0a02f5ff0ee3a07c42c81c3dfafb687bfbc4b26292edbbb0e52d409953b4fcce
umount: /run/osbuild/containers/storage/overlay: not mounted.
WARNING: umount of overlay dir failed with an error: CompletedProcess(args=['umount', '-f', '--lazy', '/run/osbuild/containers/storage/overlay'], returncode=32)
Finished module org.osbuild.container-deploy
Starting module org.osbuild.selinux
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
setfiles: Could not set context for /run/osbuild/tree/usr/libexec/openssh/sshd-session:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/libexec/openssh/sshd-auth:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/share/keyutils/request-key-debug.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/request-key:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/pesto:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/nfsidmap:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/key.dns_resolver:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system/systemd-homed.service:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system/systemd-homed-activate.service:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-user-runtime-dir:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/sleep.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-hibernate-resume:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/timesyncd.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-homework:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-pcrlock:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-run-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-integritysetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-tpm2-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/rpc-pipefs-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-getty-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-rc-local-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-veritysetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-factory-reset-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-fstab-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/nfsroot-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-debug-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/bootc-systemd-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/nfs-server-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/zram-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/kdump-dep-generator.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-system-update-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/ostree-system-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-bless-boot-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-cryptsetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-sysv-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-hibernate-resume-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-ssh-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/homed.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-homed:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf.d:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf.d/10-centos-bootc-persistent.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/sshd_config.d/20-systemd-userdb.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-ssh-issue:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/oomd.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/user.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-pcrextend:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-oomd:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/coredump.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/trusted/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/nonetwork/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/default/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/strict/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/confext.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/confext.repart.d/20-root-verity.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/confext.repart.d/30-root-verity-sig.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/portable.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/sysext.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/logind.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/pstore.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/NetworkManager/dispatcher.d/99-nvme-nbft-connect.sh:  Invalid argument
Traceback (most recent call last):
File "/run/osbuild/bin/org.osbuild.selinux", line 45, in <module>
    r = main(osbuild.api.arguments())
  File "/run/osbuild/bin/org.osbuild.selinux", line 26, in main
    selinux.setfiles(file_contexts, os.path.normpath(root), target, exclude_paths=exclude_paths)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/run/osbuild/lib/osbuild/util/selinux.py", line 55, in setfiles
    subprocess.run(["setfiles", "-F",
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
                    "-r", root,
                    ^^^^^^^^^^^
    ...<2 lines>...
                    f"{root}{path}"],
                    ^^^^^^^^^^^^^^^^^
                   check=True)
                   ^^^^^^^^^^^
  File "/usr/lib64/python3.13/subprocess.py", line 577, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['setfiles', '-F', '-r', '/run/osbuild/tree', '-e', '/run/osbuild/tree/sysroot', '/run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts', '/run/osbuild/tree/']' returned non-zero exit status 255.
Finished module org.osbuild.selinux
Finished pipeline build
manifest - failed
Output:
Failed

[supakeen]

This is (most likely) this bug: osbuild/osbuild#2494, I'll leave this open until that fix makes it to a downstream container which sadly might be a while. Sadly --in-vm is considered experimental at the moment so for now the only workaround is to run with sudo.

cc @achilleas-k as they're currently working on getting the containers built from this repository and know more about when that would make it into a container.

The setfiles warnings are indeed not important; it's because your host is not using SELinux I think but we try to have manifests be portable between hosts so we don't really want to skip that stage 🙂

[rmsc]

Not sure if related, but also get this exact error when switching build architectures (with sudo, without --in-vm). Reported it a while back in the old repo:

osbuild/bootc-image-builder#927

I've since migrated to image-builder-cli, but hadn't tried building arm images in a while. Tried today, got this:

[|] Manifest generation step
Message: Building manifest for bootc-based-qcow2
error: running aarch64 container failed: exit status 125
stderr:
Error: failed to open 2048 locks in /libpod_lock: numerical result out of range

[supakeen]

Let's see if the fix in osbuild addresses both once we have some new containers.

[supakeen]

Could those affected (@goshansp, @rmsc, etc) retry with the following container: https://github.com/osbuild/image-builder/pkgs/container/image-builder (ghcr.io/osbuild/image-builder:latest)?

[goshansp]

Thanks for pushing this - Unfortunately I still don't succeed on Fedora 44:

Missing xattrs reference

$ sudo setenforce 0
$ podman system reset
$ podman --storage-driver=overlay run --rm -it --privileged --pull=newer \
  --security-opt label=type:unconfined_t \
  -v ./rhel-rootless/templates/config.qcow2.toml:/config.toml:ro \
  -v ./output:/output \
  ghcr.io/osbuild/image-builder:latest \
  build qcow2 \
  --in-vm \
  --bootc-default-fs ext4 \
  --bootc-ref quay.io/fedora/fedora-bootc:latest
[|] Image building step
[4 / 5] Pipeline image [----------------------------------------------------------------------------------------------------------------------------------------------->____________________________________] 80.00%
[7 / 13] Stage org.osbuild.bootc.install-to-filesystem [------------------------------------------------------------------------------->____________________________________________________________________] 53.85%
Message: Finished pipeline image
error: error running osbuild: exit status 1
BuildLog:
starting -
Starting pipeline source org.osbuild.containers-storage
Finished module source org.osbuild.containers-storage
Finished pipeline org.osbuild.containers-storage
Starting pipeline build
Starting module org.osbuild.container-deploy
5e2f71d128788f3f0f0ceb0906593caf1309534ae04ba54f230bc9d0e59a1906
umount: /run/osbuild/containers/storage/overlay: not mounted.
WARNING: umount of overlay dir failed with an error: CompletedProcess(args=['umount', '-f', '--lazy', '/run/osbuild/containers/storage/overlay'], returncode=32)
Finished module org.osbuild.container-deploy
Starting module org.osbuild.selinux
Finished module org.osbuild.selinux
Finished pipeline build
Starting pipeline image
Starting module org.osbuild.truncate
Finished module org.osbuild.truncate
Starting module org.osbuild.sfdisk
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
label: gpt
label-id: 6c8b7d4a-c947-4852-acf7-19e97d0f3917
start="2048", size="2048", type="21686148-6449-6E6F-744E-656564454649", uuid="26c7fb98-4077-4c23-afb5-97f99aabb851", bootable
start="4096", size="1026048", type="C12A7328-F81F-11D2-BA4B-00A0C93EC93B", uuid="b5547b80-c7f7-451c-a4cd-e4acd2bf1656"
start="1030144", size="2097152", type="BC13C2FF-59E6-4262-A352-B275FD6F7172", uuid="3c9e8c06-24df-458b-9018-48c1cfc39712"
start="3127296", size="17844191", type="0FC63DAF-8483-4772-8E79-3D69D8477DE4", uuid="c05bacb2-27aa-4ec4-9836-8bc18c88f3e7"
{
   "partitiontable": {
      "label": "gpt",
      "id": "6C8B7D4A-C947-4852-ACF7-19E97D0F3917",
      "device": "/dev/loop0",
      "unit": "sectors",
      "firstlba": 2048,
      "lastlba": 20971486,
      "sectorsize": 512,
      "partitions": [
         {
            "node": "/dev/loop0p1",
            "start": 2048,
            "size": 2048,
            "type": "21686148-6449-6E6F-744E-656564454649",
            "uuid": "26C7FB98-4077-4C23-AFB5-97F99AABB851"
         },{
            "node": "/dev/loop0p2",
            "start": 4096,
            "size": 1026048,
            "type": "C12A7328-F81F-11D2-BA4B-00A0C93EC93B",
            "uuid": "B5547B80-C7F7-451C-A4CD-E4ACD2BF1656"
         },{
            "node": "/dev/loop0p3",
            "start": 1030144,
            "size": 2097152,
            "type": "BC13C2FF-59E6-4262-A352-B275FD6F7172",
            "uuid": "3C9E8C06-24DF-458B-9018-48C1CFC39712"
         },{
            "node": "/dev/loop0p4",
            "start": 3127296,
            "size": 17844191,
            "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
            "uuid": "C05BACB2-27AA-4EC4-9836-8BC18C88F3E7"
         }
      ]
   }
}
Finished module org.osbuild.sfdisk
Starting module org.osbuild.mkfs.fat
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mkfs.fat 4.2 (2021-01-31)
Finished module org.osbuild.mkfs.fat
Starting module org.osbuild.mkfs.ext4
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mke2fs 1.47.3 (8-Jul-2025)
Discarding device blocks:      0/262144
done
Creating filesystem with 262144 4k blocks and 65536 inodes
Filesystem UUID: e608fbef-d278-43e7-8a0c-5c4306f37c3d
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376

Allocating group tables: done
Writing inode tables: 0/8
done
Creating journal (8192 blocks):
done
Writing superblocks and filesystem accounting information:
0/8


done
Finished module org.osbuild.mkfs.ext4
Starting module org.osbuild.mkfs.ext4
device/device (org.osbuild.loopback): loop0 acquired (locked: True)
mke2fs 1.47.3 (8-Jul-2025)
Discarding device blocks:       0/2230523
done
Creating filesystem with 2230523 4k blocks and 558624 inodes
Filesystem UUID: f0155cfe-05f3-4de8-a6fd-0b02cdf6ab75
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632

Allocating group tables: done 
Writing inode tables:  0/69
done
Creating journal (16384 blocks):
done
Writing superblocks and filesystem accounting information:
0/69


done
Finished module org.osbuild.mkfs.ext4
Starting module org.osbuild.bootc.install-to-filesystem
device/disk (org.osbuild.loopback): loop0 acquired (locked: False)
mount/- (org.osbuild.ext4): mounting /dev/loop0p4 -> /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/
mount/boot (org.osbuild.ext4): mounting /dev/loop0p3 -> /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/boot
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p2 -> /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/boot/efi
Installing image: docker://quay.io/fedora/fedora-bootc:latest
Initializing ostree layout
layers already present: 0; layers needed: 65 (1.1 GB)
error:
Installing to filesystem: Creating ostree deployment: Pulling: Importing: Unencapsulating base: proxy failure: failed to invoke method FinishPipe: corrupted blob, expecting sha256:1a825cf5354c2876c3988d915f1812f2c09c7064e5b5b83694cc8ffd1177c47a and client error: Layer sha256:6b783b38d3447c714166e4d1b8ee22382a1487bdbdc4c3c6e28900ccdd720810: Importing objects: Importing object 00/53a87b4b6705bf55497ad2b66929f9058a4aff3c8446ebb305f6196c3ff7df.file: Processing content object 0053a87b4b6705bf55497ad2b66929f9058a4aff3c8446ebb305f6196c3ff7df: Missing xattrs reference
Traceback (most recent call last):
File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 92, in <module>
    r = main(args["options"], args["inputs"], args["paths"])
File "/run/osbuild/bin/org.osbuild.bootc.install-to-filesystem", line 84, in main
    subprocess.run(pargs, env=env, check=True)
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.14/subprocess.py", line 578, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['bootc', 'install', 'to-filesystem', '--source-imgref', 'containers-storage:[overlay@/run/osbuild/containers/storage2+/run/containers/storage:additionalimagestore=/run/osbuild/containers/storage]5e2f71d128788f3f0f0ceb0906593caf1309534ae04ba54f230bc9d0e59a1906', '--skip-fetch-check', '--generic-image', '--karg', 'rw', '--karg', 'console=tty0', '--karg', 'console=ttyS0', '--target-imgref', 'quay.io/fedora/fedora-bootc:latest', '/run/osbuild/mounts']' returned non-zero exit status 1.
mount/boot-efi (org.osbuild.fat): umount: /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/boot/efi unmounted
mount/boot (org.osbuild.ext4): umount: /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/boot unmounted
mount/- (org.osbuild.ext4): umount: /run/osbuildvm/store/tmp/buildroot-tmp-te7ld88c/mounts/ unmounted
Finished module org.osbuild.bootc.install-to-filesystem
Finished pipeline image
manifest - failed
Output:
qemu-system-x86_64: terminating on signal 15 from pid 1356 (/usr/bin/python3)
Failed

sudo success

hp@green:~/git/goshansp/ansible_role_template/molecule$ sudo podman --storage-driver=overlay run --rm -it --privileged --pull=newer   --security-opt label=type:unconfined_t   -v ./rhel-rootless/templates/config.qcow2.toml:/config.toml:ro   -v ./output:/output   ghcr.io/osbuild/image-builder:latest   build qcow2 --bootc-default-fs ext4   --bootc-ref quay.io/fedora/fedora-bootc:latest
Trying to pull ghcr.io/osbuild/image-builder:latest...
Getting image source signatures
Copying blob 91253a1f235f done   | 
Copying blob 961622004378 done   | 
Copying blob 86160018f613 done   | 
Copying blob 566464565cdf done   | 
Copying blob e22af1bcaf6d done   | 
Copying config 2ffcedabe9 done   | 
Writing manifest to image destination
[/] Image building step
[5 / 5] Pipeline qcow2 [---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
[2 / 2] Stage org.osbuild.qemu [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
Message: Finished pipeline qcow2
Image build successful: bootc-fedora-44-qcow2-x86_64/bootc-fedora-44-qcow2-x86_64.qcow2

@supakeen

[goshansp]

Also fails for another reason on rhel9-bootc:

$ podman run --rm -it --privileged --pull=newer   --security-opt label=type:unconfined_t  -v ./output:/output   ghcr.io/osbuild/image-builder:latest   build qcow2   --in-vm   --bootc-default-fs ext4   --bootc-ref quay.io/fedora/fedora-bootc:latest
Trying to pull ghcr.io/osbuild/image-builder:latest...
Getting image source signatures
Copying blob 141c76bdca30 done   | 
Copying blob 961622004378 skipped: already exists  
Copying blob 566464565cdf skipped: already exists  
Copying blob e22af1bcaf6d skipped: already exists  
Copying blob e621e6be8f0e done   | 
Copying config 4361e81fdd done   | 
Writing manifest to image destination
[-] Image building step
[3 / 5] Pipeline build [----------------------------------------------------------------------------------------------------------->________________________________________________________________________] 60.00%
[3 / 3] Stage org.osbuild.selinux [----------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
Message: Finished pipeline build
error: error running osbuild: exit status 1
BuildLog:
starting -
Starting pipeline source org.osbuild.containers-storage
Finished module source org.osbuild.containers-storage
Finished pipeline org.osbuild.containers-storage
Starting pipeline build
Starting module org.osbuild.container-deploy
5e2f71d128788f3f0f0ceb0906593caf1309534ae04ba54f230bc9d0e59a1906
umount: /run/osbuild/containers/storage/overlay: not mounted.
WARNING: umount of overlay dir failed with an error: CompletedProcess(args=['umount', '-f', '--lazy', '/run/osbuild/containers/storage/overlay'], returncode=32)
Finished module org.osbuild.container-deploy
Starting module org.osbuild.selinux
setfiles: Could not set context for /run/osbuild/tree/usr/libexec/openssh/sshd-session:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/libexec/openssh/sshd-auth:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/share/keyutils/request-key-debug.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/request-key:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/pesto:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/nfsidmap:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/bin/key.dns_resolver:  Invalid argument
setfiles:
Could not set context for /run/osbuild/tree/usr/lib/NetworkManager/dispatcher.d/99-nvme-nbft-connect.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/timesyncd.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-pcrlock:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/sshd_config.d/20-systemd-userdb.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/homed.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-homed:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-ssh-issue:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/user.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/oomd.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-pcrextend:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf.d:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/journald.conf.d/10-centos-bootc-persistent.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/trusted/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/nonetwork/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/default/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/portable/profile/strict/service.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-oomd:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/coredump.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/logind.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/portable.repart.d/20-root-verity.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/portable.repart.d/30-root-verity-sig.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/portable.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/sysext.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/repart/definitions/confext.repart.d/10-root.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-debug-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/ostree-system-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/rpc-pipefs-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-system-update-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-sysv-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-bless-boot-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-cryptsetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/nfsroot-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/nfs-server-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-ssh-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-hibernate-resume-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-run-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-tpm2-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-getty-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-integritysetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/kdump-dep-generator.sh:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-rc-local-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/zram-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-factory-reset-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-veritysetup-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/systemd-fstab-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system-generators/bootc-systemd-generator:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/pstore.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/ssh_config.d/20-systemd-ssh-proxy.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-user-runtime-dir:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/sleep.conf:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-hibernate-resume:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/systemd-homework:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system/systemd-homed.service:  Invalid argument
setfiles: Could not set context for /run/osbuild/tree/usr/lib/systemd/system/systemd-homed-activate.service:  Invalid argument
Traceback (most recent call last):
File "/run/osbuild/bin/org.osbuild.selinux", line 45, in <module>
    r = main(osbuild.api.arguments())
File "/run/osbuild/bin/org.osbuild.selinux", line 26, in main
    selinux.setfiles(file_contexts, os.path.normpath(root), target, exclude_paths=exclude_paths)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/run/osbuild/lib/osbuild/util/selinux.py", line 55, in setfiles
    subprocess.run(["setfiles", "-F",
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
                    "-r", root,
                    ^^^^^^^^^^^
    ...<2 lines>...
                    f"{root}{path}"],
                    ^^^^^^^^^^^^^^^^^
                   check=True)
                   ^^^^^^^^^^^
  File "/usr/lib64/python3.14/subprocess.py", line 578, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['setfiles', '-F', '-r', '/run/osbuild/tree', '-e', '/run/osbuild/tree/sysroot', '/run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts', '/run/osbuild/tree/']' returned non-zero exit status 255.
Finished module org.osbuild.selinux
Finished pipeline build
manifest - failed
Output:
Failed

[supakeen]

Those are two separate new issues. The first one mentions seems to occur in bootc itself and will need separate investigation. I've not seen it before.

The second one is a limitation of rootless builds, for which we have an open issue: #2425

These issues both seem unrelated to the libpod locking problem that this issue initially reported, if I'm reading things right at least that issue is now resolved?

It's a bit rough having all these issues but this is exactly why we consider in-vm experimental, it relies on many idiosyncrasies to get it to work in a narrow subset of cases; it is not ready for general purpose usage.

[goshansp]

Amazing, one step closer to building rootless - thanks alot to you and your teams!

[rmsc]

Not solved here, so maybe it's a different issue:

sudo podman run --rm -it --platform=linux/amd64 --privileged --pull=newer --security-opt label=type:unconfined_t -v ./config.toml:/config.toml:ro -v ./output:/output -v /var/lib/containers/storage:/var/lib/containers/storage ghcr.io/osbuild/image-builder:latest build qcow2 --arch amd64 --blueprint /config.toml --bootc-default-fs btrfs --bootc-ref <my-image>:main --output-name <my-name>-main
error: running <my-image>:main container failed: exit status 125
stderr:
Error: failed to open 2048 locks in /libpod_lock: numerical result out of range

This was right after a sudo podman system reset.

[rmsc]

Did a sudo podman system reset, then a reboot and tried a cross-arch build:

sudo podman run --rm -it --platform=linux/aarch64 --privileged --pull=newer --security-opt label=type:unconfined_t -v ./config.toml:/config.toml:ro -v ./output:/output -v /var/lib/containers/storage:/var/lib/containers/storage ghcr.io/osbuild/image-builder:latest build qcow2 --arch aarch64 --blueprint /config.toml --bootc-default-fs btrfs --bootc-ref <my-image>:main --output-name <image>-main
error: running <my-image>:main container failed: exit status 126
stderr:
Failed to re-execute libcrun via memory file descriptor
time="2026-07-10T13:41:50Z" level=error msg="Removing container 6040c49148c99bf79e9bf4d7f8e9176ab7f942532b004a2f46ba90f1085eaeab from runtime after creation failed"
Error: OCI runtime error: crun: Failed to re-execute libcrun via memory file descriptor

If I repeat the command I locking errors:

error: running git.silkmicro.com/infra/garage-node:main container failed: exit status 126
stderr:
time="2026-07-10T13:42:11Z" level=error msg="Refreshing container 91d6f63f5486a57854a325761aa83ab4f3ee129f84a30cfed281755e9db39705: acquiring lock 0 for container 91d6f63f5486a57854a325761aa83ab4f3ee129f84a30cfed281755e9db39705: file exists"
time="2026-07-10T13:42:11Z" level=error msg="Refreshing volume c898dc20548ccfc2b937684230d90bd7748819cef919be7583daa3523c9db41b: acquiring lock 1 for volume c898dc20548ccfc2b937684230d90bd7748819cef919be7583daa3523c9db41b: file exists"
Failed to re-execute libcrun via memory file descriptor
time="2026-07-10T13:42:11Z" level=error msg="Removing container 8a124a8e1497b05c9eb6ab68c8708c9061acf04a56d62fe4da41bab113e9b17c from runtime after creation failed"
Error: OCI runtime error: crun: Failed to re-execute libcrun via memory file descriptor