Lesstep
GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

"rootless netns: kill network process: permission denied" on ubuntu-latest (Ubuntu 26.04): rootless Podman and pasta

ubuntu-latest is moving from Ubuntu 24.04 to 26.04 between October 19 and November 19, 2026 (what else changes). Rootless Podman uses pasta for the network of its containers. Ubuntu 26.04 ships an AppArmor profile for pasta, /etc/apparmor.d/usr.bin.pasta, and that profile does not let pasta receive a signal from Podman. So when Podman tears down the rootless network namespace and sends pasta SIGTERM, the kernel refuses. Ubuntu 24.04 has no pasta profile, and the same job passes there.

The runner-images maintainers reproduced it on ubuntu-26.04 20261026.180.1 and ubuntu-26.04-arm 20261026.168.1 (runner-images #15182). It comes from Ubuntu itself (Ubuntu bug 2154379, filed in May 2026 and still marked Confirmed for apparmor, passt and podman on November 4), so an Ubuntu 26.04 machine of your own can show it too.

The messages

Podman's own words, from podman unshare --rootless-netns true, which exits with 126:

Error: rootless netns: cleanup: 1 error occurred:
	* rootless netns: kill network process: permission denied

Through the Docker-compatible socket, the tests pass and then docker compose down fails on the last container of the network (8Knot #1223):

 Container 8knot-redis-broker-1 Error Error while Stopping
Error response from daemon: removing container 29ee0adbe1a7... network: 1 error occurred:
	* rootless netns: kill network process: permission denied
Error: executing /usr/libexec/docker/cli-plugins/docker-compose -f docker-compose.yml down: exit status 1
Error: Process completed with exit code 1.

podman run --rm --network <bridge> prints the same error but exits with 0, so the step stays green and the message is easy to miss. The kernel log has one line for each refusal:

apparmor="DENIED" operation="signal" class="signal" profile="pasta" pid=2290 comm="podman" requested_mask="receive" denied_mask="receive" signal=term peer="podman"

Fix 1: let pasta receive the signal

This is the step the maintainers give until a fixed image reaches your job. Put it before the first step that starts rootless Podman networking. The rule has to go into the profile itself, because the 26.04 profile does not include its local/ file. The reporter's workaround job passed on ubuntu-26.04 with it.

- name: Allow podman to stop pasta (actions/runner-images#15182)
  run: |
    sudo sed -i '$ i\  signal (receive) set=(term) peer=podman,' /etc/apparmor.d/usr.bin.pasta
    sudo apparmor_parser -r /etc/apparmor.d/usr.bin.pasta

On ubuntu-24.04 the file does not exist, so the step above fails there. To keep one step for both images, and for the time after the image has the rule, add it only when the file is there and has no rule for Podman yet. The image's own fix checks the same peer=podman (runner-images #15184):

- name: Allow podman to stop pasta (actions/runner-images#15182)
  run: |
    p=/etc/apparmor.d/usr.bin.pasta
    if [ -f "$p" ] && ! sudo grep -q 'peer=podman' "$p"; then
      sudo sed -i '$ i\  signal (receive) set=(term) peer=podman,' "$p"
      sudo apparmor_parser -r "$p"
    fi

Fix 2: use slirp4netns instead of pasta

slirp4netns has no such profile. warren #62 made it Podman's default for rootless networking:

- name: Use slirp4netns for rootless networking
  run: |
    command -v slirp4netns >/dev/null || sudo apt-get install -y slirp4netns
    mkdir -p ~/.config/containers
    printf '[network]\ndefault_rootless_network_cmd = "slirp4netns"\n' > ~/.config/containers/containers.conf

This writes a new ~/.config/containers/containers.conf. If your job already writes one, put the line under its [network] table instead of replacing the file.

Fix 3: keep the Podman job on 24.04

runs-on: ubuntu-24.04

CoreOS (bootupd #1179, ignition #2351) and CHAOSS (8Knot #1225) did this in late October. It holds until GitHub retires that image.

When the image has the rule

runner-images #15184 adds the same rule to the 26.04 images, with a test that the profile has it. On November 4 it was not merged yet, and the maintainers said they would update #15182 when it is deployed. The checked step in Fix 1 then does nothing, so it can stay.

Telling it apart

Other 26.04 failures

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; Docker is a trademark of Docker, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical, Docker, Inc. or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · bubblewrap on Ubuntu 26.04 · "client version ... is too old" on Ubuntu 26.04 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語