Updating from fedora-minimal:40 breaks custom forgejo-runner (podman-in-podman) image

[Flying--Dutchman]

For learning purposes I created a small forgejo-runner image using podman-in-podman, based on fedora-minimal:40, which works great. Obviously I want to update fedora-minimal, but even the update to :41 breaks my runner.

Upon starting the podman service with podman system service --time=0 "unix:///tmp/podman.sock" & I get the following error:
time="2025-11-23T15:51:46Z" level=error msg="running /usr/bin/newuidmap 22 0 1000 1 1 10000 65535: newuidmap: write to uid_map failed: Operation not permitted\n" Error: cannot set up namespace using "/usr/bin/newuidmap": should have setuid or have filecaps setuid: exit status 1
-> Fixed with enabling setuid bit.

Currently my issue is when my runner tries to build a Containerfile in the pipeline/workflow, which results in:

running `/usr/bin/newuidmap 126 0 1000 1 1 1 999 1000 1001 64535`: newuidmap: write to uid_map failed: Operation not permitted\n"
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

Also fixed, with picking another subid-range: 200000:65536

The (outer/runner) container, is started with --privileged.
My (very basic) Containerfile:

FROM code.forgejo.org/forgejo/runner:11.3.1@sha256:bd53a0d628e0c6188320b8a828a727f066e7c9ddf5b95f0d382ca75644346231 AS forgejo-runner-app

FROM quay.io/fedora/fedora-minimal:41 AS forgejo-runner-base

ARG FORGEJO_RUNNER_VERSION=11.2.0 \
    FORGEJO_RUNNER_SHA256=02957e46aad5e20628166001750cacd241d117043090d4bbd9298476c50cb767
    
ENV FORGEJO_URL="" \
    FORGEJO_TOKEN="" \
    FORGEJO_NAME="forgejo-runner-pinp" \
    FORGEJO_LABELS="podman" \
    DOCKER_SOCK="/tmp/podman.sock" \
    DOCKER_HOST="unix:///tmp/podman.sock"

RUN microdnf install -y \
    podman \
    fuse-overlayfs \
    slirp4netns \
    shadow-utils \
    curl \
    bash && \
    microdnf clean all

RUN mkdir -p /opt/forgejo/conf && \
    mkdir -p /opt/supersonic

WORKDIR /opt/forgejo

RUN \
    
    # Setup podman to use nftables
    mkdir -p /etc/containers && \
    echo "[engine]" > /etc/containers/containers.conf && \
    echo "network_backend = \"netavark\"" >> /etc/containers/containers.conf && \
    echo "[network]" >> /etc/containers/containers.conf && \
    echo "firewall_driver = \"nftables\"" >> /etc/containers/containers.conf

ARG UID=1000 \
    GID=1000 \
    SUBIDS=10000:65535

COPY --from=forgejo-runner-app /bin/forgejo-runner /opt/forgejo/runner
COPY entrypoint.sh /entrypoint.sh

RUN \

    # Add runner user and set permissions
    groupadd -g "${GID}" runner && \
    useradd --create-home --no-log-init -u "${UID}" -g "${GID}" runner && \
    chown -R runner:runner /opt/forgejo && \
    chown runner:runner /etc/containers/registries.conf && \
    chmod +x /entrypoint.sh && \
    chown runner:runner /entrypoint.sh && \
    
    # Set sub ids if set
    if [ -n "${SUBIDS}" ]; then \
      echo "runner:${SUBIDS}" > /etc/subuid && \
      echo "runner:${SUBIDS}" > /etc/subgid; \
    fi

USER runner  


VOLUME ["/opt/forgejo/conf"]
ENTRYPOINT ["/entrypoint.sh"]

[Flying--Dutchman]

Both issues have been fixed. For future reference:

1. Make sure setuid bit is enabled
2. Make sure subid-range is valid