Podman rootless container fails inside VSCodium AppImage

[Tealk]

When trying to open a Podman container (e.g., Fedora Toolbox) or enter a Distrobox container from within the VSCodium AppImage environment, I encounter two separate issues:

1. Podman reports missing subordinate UID/GID ranges for the user.
2. Podman and related tools fail with symbol lookup errors related to libselinux.so.1 and libsemanage.so.2.

These problems prevent using Podman rootless containers inside the VSCodium AppImage shell.

Steps to reproduce

1. Run VSCodium as an AppImage on a Linux system.
2. Inside the VSCodium terminal, try to enter a Podman container or Fedora Toolbox instance, e.g.:

   toolbox enter
   

   or

   distrobox enter Debian
   

3. Observe the errors.

Actual error messages

Error: Missing subgid and/or subuid ranges for user tealk
See the podman(1), subgid(5), subuid(5) and usermod(8) manuals for more information.

and

sed: /tmp/.mount_vscodim8QyNQ/lib/x86_64-linux-gnu/libselinux.so.1: no version information available (required by sed)
podman: /tmp/.mount_vscodim8QyNQ/lib/x86_64-linux-gnu/libselinux.so.1: no version information available (required by /lib64/libsubid.so.5)
podman: /tmp/.mount_vscodim8QyNQ/lib/x86_64-linux-gnu/libselinux.so.1: no version information available (required by /lib64/libsemanage.so.2)
podman: symbol lookup error: /lib64/libsemanage.so.2: undefined symbol: selinux_restorecon, version LIBSELINUX_1.0

Additional information

• The subuid and subgid ranges are configured correctly on the host system.
• The errors appear only when running Podman or Distrobox commands inside the VSCodium AppImage environment.
• The AppImage bundles its own libselinux.so.1, which conflicts with the system libraries required by Podman and related tools.
• Running Podman outside the AppImage works as expected.

[aaronthefullstackengineer]

Hi @Tealk — thanks for bringing this up. That’s a tricky interaction; I ran into something quite similar, so maybe we can narrow it down together.

What I observe

• The error about missing subuid / subgid suggests Podman sees no subordinate UID/GID mapping for your user inside the AppImage sandbox.
• The symbol lookup errors (libselinux.so.1, libsemanage.so.2) strongly hint that the bundled libraries in the AppImage are conflicting with the system’s SELinux / policy libs, which Podman expects.
• Outside the AppImage container, Podman works fine, as you said — so the host config is likely correct.

Things to check / suggestions

1. Ensure subuid / subgid entries are correct and accessible inside the AppImage
   Even if /etc/subuid and /etc/subgid are configured properly on the host, the AppImage’s sandbox might not see them or be able to read them (due to mount namespaces or permissions).
   Try binding them explicitly, or check if the AppImage disables or restricts access to /etc.

2. Avoid the library conflict

   • The AppImage bundles its own libselinux.so.1 and friends. These may be older or incompatible with the system’s version that Podman expects.
   • Workaround: use the --appimage-extract-and-run mode (or extract the AppImage and manually adjust LD_LIBRARY_PATH) so system libraries take precedence.
   • Another option: rebuild or repackage VSCodium’s AppImage without bundling SELinux / policy libs.

3. Namespace / sandbox boundary tweaks

   • Sometimes using --no-sandbox or altering mount / namespace flags helps in these hybrid container-in-container cases (though it may reduce isolation).
   • Check if VSCodium’s terminal environment (inside the AppImage) is mounting /proc, /sys, /etc in a way that breaks those lookups.

4. Alternative approach: don’t run Podman from inside the AppImage

   • Instead, run the containers / tooling externally (in a normal shell) and connect to them (via docker / podman APIs, remote ports, or SSH / sockets).
   • Use the AppImage primarily for the editor, not for launching system-level containers.

Example debugging steps

• Run ldd on your Podman binary inside the AppImage shell to see which libselinux / libsemanage it’s resolving to.
• Try straceing Podman to see where it’s failing to open /etc/subuid or libselinux.
• Extract the AppImage (appimagetool --appimage-extract) and run in a custom environment to override or disable those bundled libs.

If you like, I can prepare a patch suggestion (for VSCodium’s AppImage) or a minimal repro script you could attach. Do you want me to build that?

[Tealk]

Hi, thanks for the detailed answer. I don't know how much work the patch would be, but for me personally, it's not worth the effort right now.
Currently, I'm using the files from the .tar.gz, which runs quite stably. I use containers to work cleanly with Ansible without having to install everything via rpm-ostree.

[aaronthefullstackengineer]

No problem bro. I am always creeping ready to help.

[Tealk]

It worked once, but some package update destroyed it. Unfortunately, this is not so easy to verify in Fedora silverblue.

Maybe I'll distrohop to Debian xD