From 6c236a236c1bf338710c935c303fe994f160a758 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Thu, 23 Feb 2023 10:02:33 -0800
Subject: [PATCH] more informative error message for user namespace exhaustion

PiperOrigin-RevId: 511815341
---
 runsc/specutils/namespace.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/runsc/specutils/namespace.go b/runsc/specutils/namespace.go
index 4ae39da1c..09c723f82 100644
--- a/runsc/specutils/namespace.go
+++ b/runsc/specutils/namespace.go
@@ -198,7 +198,11 @@ func startInNS(cmd *exec.Cmd, nss []specs.LinuxNamespace) ([]func() error, error
 		deferFuncs = append(deferFuncs, restoreNS)
 	}
 
-	return deferFuncs, cmd.Start()
+	err := cmd.Start()
+	if err != nil && cmd.SysProcAttr.Cloneflags&unix.CLONE_NEWUSER != 0 {
+		err = fmt.Errorf("%v: check whether /proc/sys/user/max_user_namespaces is set too low (gvisor.dev/issue/5964)", err)
+	}
+	return deferFuncs, err
 }
 
 // SetUIDGIDMappings sets the given uid/gid mappings from the spec on the cmd.