Excessive warning when run as rootless (Hint: enable cgroup v2 delegation is printed even when it is already enabled)

[ricardobranco777]

Description

Excessive warning when run as rootless

Steps to reproduce the issue

From the automated BATS testsuite:

WARNING: The bats command will remove all existing containers & images.

1. Install bats
2. git clone --depth 1 https://github.com/containers/podman
3. cd podman/test/system
4. PODMAN=/usr/bin/podman QUADLET=/usr/libexec/podman/quadletbats -t 195-run-namespaces.bats

Describe the results you received and expected

Expected:
pid:\[4026532491\]

Received:

pid:[4026532491]
# time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"

Full commands:

# [06:24:42.454494507] $ /usr/bin/podman run --name c-cgroup-t359-8qf994tn --cgroupns private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/cgroup; sleep inf
# [06:24:42.664840627] 80ed1b81112e595e6e19590d7aab4216d286174a4e5ed437ef8cb1e5c2d5ff73
#
# [06:24:42.670640534] $ /usr/bin/podman run --rm --cgroupns container:c-cgroup-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/cgroup
# [06:24:42.985568894] cgroup:[4026532492]
#
# [06:24:42.996644307] $ /usr/bin/podman logs c-cgroup-t359-8qf994tn
# [06:24:43.046330438] cgroup:[4026532492]
#
# [06:24:43.059614118] $ /usr/bin/podman rm -f -t0 c-cgroup-t359-8qf994tn
# [06:24:43.284763404] c-cgroup-t359-8qf994tn
#
# [06:24:43.296239483] $ /usr/bin/podman run --name c-ipc-t359-8qf994tn --ipc shareable -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/ipc; sleep inf
# [06:24:43.497113256] 1f0eeeff57673dabcd162a7f92b3e45a93f9f423268dd757fff468518922ad58
#
# [06:24:43.503286819] $ /usr/bin/podman run --rm --ipc container:c-ipc-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/ipc
# [06:24:43.815077757] ipc:[4026532490]
#
# [06:24:43.825436117] $ /usr/bin/podman logs c-ipc-t359-8qf994tn
# [06:24:43.888895038] ipc:[4026532490]
#
# [06:24:43.902312689] $ /usr/bin/podman rm -f -t0 c-ipc-t359-8qf994tn
# [06:24:44.103551710] c-ipc-t359-8qf994tn
#
# [06:24:44.115515517] $ /usr/bin/podman run --name c-net-t359-8qf994tn --network private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/net; sleep inf
# [06:24:44.300356125] 0e678cbdf7f7c6f71748fbda4b82fd92bf4b368f38cccb7670334439319e1b00
#
# [06:24:44.306870863] $ /usr/bin/podman run --rm --network container:c-net-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/net
# [06:24:44.631963661] net:[4026532412]
#
# [06:24:44.644109702] $ /usr/bin/podman logs c-net-t359-8qf994tn
# [06:24:44.702946435] net:[4026532412]
#
# [06:24:44.717406455] $ /usr/bin/podman rm -f -t0 c-net-t359-8qf994tn
# [06:24:44.932304778] c-net-t359-8qf994tn
#
# [06:24:44.942977974] $ /usr/bin/podman run --name c-pid-t359-8qf994tn --pid private -d quay.io/libpod/testimage:20241011 sh -c readlink /proc/self/ns/pid; sleep inf
# [06:24:45.138506420] 1a0f7be22e5c02a34f0777e33179fa80a6e05352febecd04982aa379ac1d9810
#
# [06:24:45.145252051] $ /usr/bin/podman run --rm --pid container:c-pid-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/pid
# [06:24:45.471202035] pid:[4026532491]
# time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"
#
# [06:24:45.482752827] $ /usr/bin/podman logs c-pid-t359-8qf994tn
# [06:24:45.546485301] pid:[4026532491]
# #/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
# #|     FAIL: (pid) namespace matches (type: private)
# #| expected: pid:\[4026532491\]
# #|         > time=\"2025-04-16T06:24:45-04:00\" level=warning msg=\"failed to kill all processes\, possibly due to lack of cgroup \(Hint: enable cgroup v2 delegation\)\" error=\"cgroup not exist\"
# #|   actual: pid:\[4026532491\]
# #\^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

What version of runc are you using?

runc version 1.2.6
commit: v1.2.6-0-ge89a29929c77
spec: 1.2.0
go: go1.24.2
libseccomp: 2.6.0

Host OS information

NAME="openSUSE Tumbleweed"
# VERSION="20250414"
ID="opensuse-tumbleweed"
ID_LIKE="opensuse suse"
VERSION_ID="20250414"
PRETTY_NAME="openSUSE Tumbleweed"
ANSI_COLOR="0;32"
# CPE 2.3 format, boo#1217921
CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20250414:*:*:*:*:*:*:*"
#CPE 2.2 format
#CPE_NAME="cpe:/o:opensuse:tumbleweed:20250414"
BUG_REPORT_URL="https://bugzilla.opensuse.org"
SUPPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
LOGO="distributor-logo-Tumbleweed"

Host kernel information

Linux opensuse 6.14.1-1-default #1 SMP PREEMPT_DYNAMIC Mon Apr 7 08:22:06 UTC 2025 (ca98696) x86_64 x86_64 x86_64 GNU/Linux

[lifubang]

> # [06:24:45.145252051] $ /usr/bin/podman run --rm --pid container:c-pid-t359-8qf994tn quay.io/libpod/testimage:20241011 readlink /proc/self/ns/pid
> # [06:24:45.471202035] pid:[4026532491]
> # time="2025-04-16T06:24:45-04:00" level=warning msg="failed to kill all processes, possibly due to lack of cgroup (Hint: enable cgroup v2 delegation)" error="cgroup not exist"
> #

So this is an example of start a rootless container with a shared pid namespace of the host, we wanted to abandon this type container, but we decided to just print a warn message by considering the backward compatibility, for more informations, please see:
#4395 (comment)
#4395 (review)

If you have a way to kill all processes in this type container, feel free to let us know.

[ricardobranco777]

So this is an example of start a rootless container with a shared pid namespace of the host, we wanted to abandon this type container, but we decided to just print a warn message by considering the backward compatibility, for more informations, please see: #4395 (comment) #4395 (review)

If you have a way to kill all processes in this type container, feel free to let us know.

The problem is that the warning is misleading: the cgroup exists & cgroups v2 delegation is enabled.