Podman build fails: Couldn't open network namespace /proc/9854/ns/net

[Nextross]

Hi, I am trying to build an image with Podman on Debian 12, but any network request fails with this error:

Error: building at STEP "RUN ping -4 -c 1 google.com": setup network: pasta failed with exit code 1:
No external routable interface for IPv6
Couldn't open network namespace /proc/9854/ns/net

The command for building this image is: podman build --tag=test .. The container file looks like this:

FROM docker.io/eclipse-temurin:21-jre-ubi10-minimal AS build

WORKDIR /data
# FAILS
RUN ping -c 1 google.com
RUN curl -o server.jar \
        https://meta.fabricmc.net/v2/versions/loader/1.21.10/0.18.1/1.1.0/server/jar
RUN java -jar server.jar
# Accept eula
RUN echo "eula=true" > eula.txt

FROM gcr.io/distroless/java21-debian12
WORKDIR /data
COPY --from=build /data /data

EXPOSE 22565/tcp
EXPOSE 22565/udp

CMD ["server.jar", "nogui"]

I am using Podman version 6.0.0-dev, which I built myself, as Debian 12 only has Podman 4.3.1 version. I looked around logs, but they don't show anything. What could it be?

[afbjorklund]

What is your version of passt? I used 2025_09_19.623dbf6, for podman 5.6.2

[Nextross]

When running passt --version I get passt unknown version, but as it's Debian 12, it should be version 0.0~git20230309.7c7625d-1 (found here).

[afbjorklund]

But since you are not using the system packages, you might need to upgrade the dependencies as well...

[Nextross]

Yeah you're right. In the end it'll probably be easier to upgrade to Debian 13, as the newer version of passt requieres libc6 >= 2.38 and upgrading that would probably resolve in other issues

[afbjorklund]

"Why not just build from source?" :-) You will probably have to do the same with conmon/crun/netavark/aardvark

[Nextross]

Haha yeah, I guess that's why

[Luap99]

I think answered that already on matrix. Most likely apparmor is blocking that access if you are on debian so you need to be sure you have the proper latest version of passt installed with the right profile.
If it is apparmor the kernel logs should show the denials AFAIK.