Diagnostic code

ZBX-E0203

can't create the container's namespaces

Kind

error

Blame

environment

Exit code

2 (125 in zbx run)

What it means

zbx runs a container in new user, mount, PID, UTS, IPC and network namespaces and writes the id maps of the user namespace. The kernel refused one of these, or a setting forbids it, so the container was not started.

The cause names what failed. The usual reason is a restriction on unprivileged user namespaces: user.max_user_namespaces is 0, kernel.unprivileged_userns_clone is 0 (Debian), AppArmor restricts them (the Ubuntu 24.04 default), or a seccomp filter around zbx, as inside another container, blocks clone3. "zbx doctor" runs the same check and prints the command that fixes the setting (ZBX-E0101).

A refused id map means the user namespace exists but could not be mapped. Without the helper newuidmap only the user's own id can be mapped.

Offline

The same text, without a network:

zbx explain E0203