4 files changed, 61 insertions, 17 deletions

diff --git a/cmd/podman/main_local.go b/cmd/podman/main_local.go
index 917096e17..bdffb6b1e 100644
--- a/cmd/podman/main_local.go
+++ b/cmd/podman/main_local.go
@@ -200,17 +200,12 @@ func setupRootless(cmd *cobra.Command, args []string) error {
 		return errors.Wrapf(err, "could not get pause process pid file path")
 	}
 
-	if _, err := os.Stat(pausePidPath); err == nil {
-		became, ret, err := rootless.TryJoinFromFilePaths("", false, []string{pausePidPath})
-		if err != nil {
-			logrus.Errorf("cannot join pause process.  You may need to remove %s and stop all containers", pausePidPath)
-			logrus.Errorf("you can use `%s system migrate` to recreate the pause process and restart the containers", os.Args[0])
-			logrus.Errorf(err.Error())
-			os.Exit(1)
-		}
-		if became {
-			os.Exit(ret)
-		}
+	became, ret, err := rootless.TryJoinPauseProcess(pausePidPath)
+	if err != nil {
+		return err
+	}
+	if became {
+		os.Exit(ret)
 	}
 
 	// if there is no pid file, try to join existing containers, and create a pause process.
@@ -225,7 +220,7 @@ func setupRootless(cmd *cobra.Command, args []string) error {
 		paths = append(paths, ctr.Config().ConmonPidFile)
 	}
 
-	became, ret, err := rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
+	became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, true, paths)
 	if err := movePauseProcessToScope(); err != nil {
 		conf, err := runtime.GetConfig()
 		if err != nil {
diff --git a/libpod/boltdb_state.go b/libpod/boltdb_state.go
index e43d54eee..0bb1df7b8 100644
--- a/libpod/boltdb_state.go
+++ b/libpod/boltdb_state.go
@@ -2,6 +2,7 @@ package libpod
 
 import (
 	"bytes"
+	"os"
 	"strings"
 	"sync"
 
@@ -658,9 +659,13 @@ func (s *BoltState) UpdateContainer(ctr *Container) error {
 		return err
 	}
 
-	// Handle network namespace
-	if err := replaceNetNS(netNSPath, ctr, newState); err != nil {
-		return err
+	// Handle network namespace.
+	if os.Geteuid() == 0 {
+		// Do it only when root, either on the host or as root in the
+		// user namespace.
+		if err := replaceNetNS(netNSPath, ctr, newState); err != nil {
+			return err
+		}
 	}
 
 	// New state compiled successfully, swap it into the current state
diff --git a/pkg/rootless/rootless.go b/pkg/rootless/rootless.go
new file mode 100644
index 000000000..7e9fe9db6
--- /dev/null
+++ b/pkg/rootless/rootless.go
@@ -0,0 +1,45 @@
+package rootless
+
+import (
+	"os"
+
+	"github.com/containers/storage"
+	"github.com/pkg/errors"
+)
+
+func TryJoinPauseProcess(pausePidPath string) (bool, int, error) {
+	if _, err := os.Stat(pausePidPath); err != nil {
+		return false, -1, nil
+	}
+
+	became, ret, err := TryJoinFromFilePaths("", false, []string{pausePidPath})
+	if err == nil {
+		return became, ret, err
+	}
+
+	// It could not join the pause process, let's lock the file before trying to delete it.
+	pidFileLock, err := storage.GetLockfile(pausePidPath)
+	if err != nil {
+		// The file was deleted by another process.
+		if os.IsNotExist(err) {
+			return false, -1, nil
+		}
+		return false, -1, errors.Wrapf(err, "error acquiring lock on %s", pausePidPath)
+	}
+
+	pidFileLock.Lock()
+	defer func() {
+		if pidFileLock.Locked() {
+			pidFileLock.Unlock()
+		}
+	}()
+
+	// Now the pause PID file is locked.  Try to join once again in case it changed while it was not locked.
+	became, ret, err = TryJoinFromFilePaths("", false, []string{pausePidPath})
+	if err != nil {
+		// It is still failing.  We can safely remove it.
+		os.Remove(pausePidPath)
+		return false, -1, nil
+	}
+	return became, ret, err
+}
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 6f6239e5f..05d641383 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -566,10 +566,10 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 
 			r, w := os.NewFile(uintptr(fds[0]), "read file"), os.NewFile(uintptr(fds[1]), "write file")
 
-			defer errorhandling.CloseQuiet(w)
 			defer errorhandling.CloseQuiet(r)
 
 			if _, _, err := becomeRootInUserNS("", path, w); err != nil {
+				w.Close()
 				lastErr = err
 				continue
 			}
@@ -578,7 +578,6 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 				return false, 0, err
 			}
 			defer func() {
-				errorhandling.CloseQuiet(r)
 				C.reexec_in_user_namespace_wait(-1, 0)
 			}()