Hello there,
I have issues with incus and idmap on a fresh Fedora Silverblue install.
Incus is installed as a layered package, see rpm-ostree status.
rpm-ostree status
rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
ā fedora:fedora/44/x86_64/silverblue
Version: 44.20260831.0 (2026-08-31T16:43:12Z)
BaseCommit: 12ab6899698760315d7ba05f4ab492a236cabceb20e78ccba92434a05edcaf19
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
LayeredPackages: incus incus-client incus-selinux [...]
The sub{u,g}id files exist before incus starts with following content:
$ cat /etc/sub{u,g}id
b0ride:524288:65536
b0ride:524288:65536
This is the launch command:
$ incus launch images:rockylinux/10/amd64
Launching the instance
Error: Failed instance creation: Failed creating instance record: Failed initializing instance: System doesn't have a functional idmap setup
systemd-journal with --verbose
$ journalctl -f -b -u incus
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg="Starting up" mode=normal path=/var/lib/incus version=6.19.1
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=error msg="Unable to parse system idmap" err="No map found for user"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=warning msg="AppArmor support has been disabled because of lack of kernel support"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg="Kernel features:"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - closing multiple file descriptors efficiently: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - netnsid-based network retrieval: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - pidfds: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - pidfds for threads: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - core scheduling: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - uevent injection: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - seccomp listener: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - seccomp listener continue syscalls: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - seccomp listener add file descriptors: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - attach to namespaces via pidfds: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - safe native terminal allocation: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - unprivileged binfmt_misc: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - unprivileged file capabilities: yes"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - cgroup layout: cgroup2"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=warning msg=" - AppArmor support has been disabled, Disabled because of lack of kernel support"
Sep 02 08:13:24 localhost incusd[13193]: time="2026-09-02T08:13:24+02:00" level=info msg=" - idmapped mounts kernel support: yes"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=warning msg="Instance type not operational" driver=qemu err="QEMU command not available: exec: \"qemu-system-x86_64\": executable file not found in $PATH" type=virtual-machine
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Instance type operational" driver=lxc type=container
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initializing local database"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Set client certificate to server certificate" fingerprint=b80f632c2bd60dd319e1effee29f016db07f59d456a94e9f4fb8c7444470ac17
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Starting database node" id=1 local=1 role=voter
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Loading daemon configuration"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Binding socket" inherited=true socket=/run/incus/unix.socket type="REST API Unix socket"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Binding socket" socket=/var/lib/incus/guestapi/sock type="devIncus socket"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initializing global database"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Connecting to global database"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Connected to global database"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initialized global database"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Firewall loaded driver" driver=nftables
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initializing storage pools"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initialized storage pool" pool=default
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="All storage pools initialized"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initializing daemon storage mounts"
Sep 02 08:13:25 localhost incusd[13193]: time="2026-09-02T08:13:25+02:00" level=info msg="Initializing networks"
Sep 02 08:13:25 localhost dnsmasq[13272]: started, version 2.92rel2 cachesize 150
Sep 02 08:13:25 localhost dnsmasq[13272]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth DNSSEC loop-detect inotify dumpfile
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCP, IP range 10.220.102.2 -- 10.220.102.254, lease time 1h
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCPv6 stateless on incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCPv4-derived IPv6 names on incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: router advertisement on incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCPv6 stateless on fd42:4bc7:4047:faf0::, constructed for incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCPv4-derived IPv6 names on fd42:4bc7:4047:faf0::, constructed for incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: router advertisement on fd42:4bc7:4047:faf0::, constructed for incusbr0
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: IPv6 router advertisement enabled
Sep 02 08:13:25 localhost dnsmasq-dhcp[13272]: DHCP, sockets bound exclusively to interface incusbr0
Sep 02 08:13:25 localhost dnsmasq[13272]: using only locally-known addresses for incus
Sep 02 08:13:25 localhost dnsmasq[13272]: reading /etc/resolv.conf
Sep 02 08:13:25 localhost dnsmasq[13272]: using nameserver 127.0.0.53#53
Sep 02 08:13:25 localhost dnsmasq[13272]: using only locally-known addresses for incus
Sep 02 08:13:25 localhost dnsmasq[13272]: read /etc/hosts - 8 names
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Initialized network" name=incusbr0 project=default
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="All networks initialized"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Cleaning up leftover image files"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Done cleaning up leftover image files"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Starting device monitor"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Initialized filesystem monitor" driver=fanotify path=/dev
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Started seccomp handler" path=/run/incus/seccomp.socket
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Pruning expired images"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Done pruning expired images"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Pruning expired backups"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Done pruning expired backups"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Expiring log files"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Pruning resolved warnings"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Done expiring log files"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Done pruning resolved warnings"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Updating images"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Updating instance types"
Sep 02 08:13:26 localhost incusd[13193]: time="2026-09-02T08:13:26+02:00" level=info msg="Daemon started"
Sep 02 08:13:26 localhost systemd[1]: Started incus.service - Incus - Daemon.
Sep 02 08:13:29 localhost incusd[13193]: time="2026-09-02T08:13:29+02:00" level=info msg="Creating instance" ephemeral=false instance=large-asp instanceType=container project=default
Sep 02 08:13:29 localhost incusd[13193]: time="2026-09-02T08:13:29+02:00" level=error msg="Failed initializing instance" err="System doesn't have a functional idmap setup" instance=large-asp project=default type=container
Sep 02 08:13:30 localhost incusd[13193]: time="2026-09-02T08:13:30+02:00" level=info msg="Done updating images"
Sep 02 08:13:30 localhost incusd[13193]: time="2026-09-02T08:13:30+02:00" level=info msg="Done updating instance types"