podman build fails for Debian/Ubuntu-based Dockerfiles inside Che workspace due to subuid range

Describe the bug

Running podman build inside a Che workspace fails for any Dockerfile that uses apt-get (Debian/Ubuntu-based images). The apt package manager drops privileges to UID 65534 (nobody) for sandboxing, but UDI's /etc/subuid maps only 64535 UIDs (user:1001:64535), so UID 65534 falls outside the mapped range.

Steps to reproduce

1. Open Eclipse Che dashboard
2. Create a workspace from https://github.com/coder/envbuilder-starter-devcontainer
3. Open a terminal in the workspace
4. Run: podman build -f .devcontainer/Dockerfile .

Observed behavior

STEP 2/6: RUN apt-get update
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)
subprocess exited with status 100
Error: building at STEP "RUN apt-get update": exit status 100

Expected behavior

podman build should succeed for Debian/Ubuntu-based Dockerfiles inside a Che workspace.

Root cause

• UDI ships /etc/subuid with user:1001:64535 — maps UIDs 0 through 64535
• apt drops to UID 65534 (nobody) for sandbox operations, which is outside this range
• The kernel's outer uid_map caps total mappable UIDs at 65536
• Since podman's first mapping uses 1 UID (0 1000 1), the second can only go up to 65535 — so the subuid range cannot simply be widened to cover UID 65534

Che version

Latest (tested August 2026)

Environment

• OpenShift cluster
• UDI: quay.io/devfile/universal-developer-image:ubi9-latest
• Podman 5.6.0, rootless, overlay storage
• SCC: container-run