Baike.dev
Log in
Back to tool/Back to issues
#27713·podman

Fails to start quadlet with pass driver: "no such secret" (exit code 126)

Author: BarnouxCreated Dec 8, 2025Updated Sep 17, 2026
Labelskind/bugstale-issuetriaged

Issue Description

When attempting to start the pass_driver.service using Podman and systemd, the service fails.

Steps to reproduce the issue

  1. install gpg and pass on your host, if not already present
bash
sudo apt-get install gpg pass
  1. Generate a gpg key and init pass
bash
gpg --full-generate-key
# to get the <NEW_KEY_ID> of the GPG key, you can use : gpg --list-secret-keys --keyid-format LONG
pass init <NEW_KEY_ID>
  1. Generate the secret from your newly created gpg key
bash
gpg --output test_password.gpg --symmetric test_password.txt
  1. Create the secret in podman with the file driver.
bash
podman secret create --driver=pass test_password ./test_password.gpg
  1. create ~/.config/containers/systemd/pass_driver.container :
systemd
[Unit]
Description=test pass driver

[Container]
Image=debian
ContainerName=test_pass_driver
Exec=env

Secret=test_password,type=env,target=PASSWORD

[Install]
WantedBy=default.target
  1. Generate the system service file
bash
systemctl --user daemon-reload
  1. Start the quadlet and verify the status of the quadlets
bash
systemctl --user start pass_driver.service
systemctl --user status pass_driver.service

Describe the results you received

bash
× pass_driver.service - test pass driver
     Loaded: loaded (/home/barnoux/.config/containers/systemd/pass_driver.container; generated)
     Active: failed (Result: exit-code) since Mon 2025-12-08 11:58:04 CET; 2h 15min ago
   Duration: 179ms
 Invocation: c2951ffeca924cbf8f84376f8d47622b
    Process: 310860 ExecStart=/usr/bin/podman run --name test_pass_driver --cidfile=/run/user/1000/pass_driver.cid --replace --rm --cgroups=split --sdnotify=conmon -d --secret test_password,type=env,target=PAS>
    Process: 310889 ExecStopPost=/usr/bin/podman rm -v -f -i --cidfile=/run/user/1000/pass_driver.cid (code=exited, status=0/SUCCESS)
   Main PID: 310860 (code=exited, status=126)
   Mem peak: 28.3M
        CPU: 439ms

déc. 08 11:58:03 srvone4all systemd[782]: Starting pass_driver.service - test pass driver...
déc. 08 11:58:03 srvone4all podman[310860]: 2025-12-08 11:58:03.220099923 +0100 CET m=+0.116415982 container create 4cf1c2ee8b4a4396b654f96d8bd52a462b41948e4755f2ba7203b5d88c902f1f (image=docker.io/library/debian:latest, name=test_pass_driver, PODMAN_SYSTEMD_UNIT=pass_driver.service)
déc. 08 11:58:03 srvone4all podman[310860]: 2025-12-08 11:58:03.183120168 +0100 CET m=+0.079436283 image pull 3371ff9331d70e04ba190b3c55c710d5af2b34ed09e76dbce05cafeb65bf0924 debian
déc. 08 11:58:04 srvone4all podman[310860]: 2025-12-08 11:58:04.362744576 +0100 CET m=+1.259060692 container remove 4cf1c2ee8b4a4396b654f96d8bd52a462b41948e4755f2ba7203b5d88c902f1f (image=docker.io/library/debian:latest, name=test_pass_driver, PODMAN_SYSTEMD_UNIT=pass_driver.service)
déc. 08 11:58:04 srvone4all pass_driver[310860]: Error: af9002553ed11f97c23918fa8: no such secret
déc. 08 11:58:04 srvone4all systemd[782]: pass_driver.service: Main process exited, code=exited, status=126/n/a
déc. 08 11:58:04 srvone4all systemd[782]: pass_driver.service: Killing process 310882 (gpg-agent) with signal SIGKILL.
déc. 08 11:58:04 srvone4all systemd[782]: pass_driver.service: Failed with result 'exit-code'.
déc. 08 11:58:04 srvone4all systemd[782]: Failed to start pass_driver.service - test pass driver.

Describe the results you expected

bash
○ pass_driver.service - test pass driver
     Loaded: loaded (/home/barnoux/.config/containers/systemd/pass_driver.container; generated)
     Active: inactive (dead) since Mon 2025-12-08 14:22:28 CET; 3s ago
   Duration: 192ms
 Invocation: 6c94c09a1cce471aad6cecdbe343bb4d
    Process: 311676 ExecStart=/usr/bin/podman run --name test_pass_driver --cidfile=/run/user/1000/pass_driver.cid --replace --rm --cgroups=split --sdnotify=conmon -d --secret test_password,type=env,target=PASSWORD debian env (code=exited, status=0/SUCCESS)
    Process: 311694 ExecStop=/usr/bin/podman rm -v -f -i --cidfile=/run/user/1000/pass_driver.cid (code=exited, status=0/SUCCESS)
    Process: 311704 ExecStopPost=/usr/bin/podman rm -v -f -i --cidfile=/run/user/1000/pass_driver.cid (code=exited, status=0/SUCCESS)
   Main PID: 311676 (code=exited, status=0/SUCCESS)
   Mem peak: 27.2M
        CPU: 735ms

déc. 08 14:22:27 srvone4all systemd[782]: Started pass_driver.service - test pass driver.
déc. 08 14:22:27 srvone4all test_pass_driver[311676]: container=podman
déc. 08 14:22:27 srvone4all test_pass_driver[311676]: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
déc. 08 14:22:27 srvone4all test_pass_driver[311676]: HOME=/root
déc. 08 14:22:27 srvone4all test_pass_driver[311676]: HOSTNAME=0081712b4f3a
déc. 08 14:22:27 srvone4all test_pass_driver[311676]: PASSWORD=bskjULINlEPhPr0
déc. 08 14:22:27 srvone4all test_pass_driver[311676]:
déc. 08 14:22:27 srvone4all pass_driver[311655]: 0081712b4f3ac32d866193ac853dd6d17153fffc6d93c8cff26cf1f41286ea33
déc. 08 14:22:27 srvone4all podman[311682]: 2025-12-08 14:22:27.682446473 +0100 CET m=+0.075453504 container died 0081712b4f3ac32d866193ac853dd6d17153fffc6d93c8cff26cf1f41286ea33 (image=docker.io/library/debian:latest, name=test_pass_driver, PODMAN_SYSTEMD_UNIT=pass_driver.service)
déc. 08 14:22:27 srvone4all podman[311682]: 2025-12-08 14:22:27.750833059 +0100 CET m=+0.143840071 container remove 0081712b4f3ac32d866193ac853dd6d17153fffc6d93c8cff26cf1f41286ea33 (image=docker.io/library/debian:latest, name=test_pass_driver, PODMAN_SYSTEMD_UNIT=pass_driver.service)

podman info output

yaml
barnoux@srvone4all:~$ podman version
Client:        Podman Engine
Version:       5.4.2
API Version:   5.4.2
Go Version:    go1.24.4
Built:         Fri Jul 25 23:39:38 2025
Build Origin:  Debian
OS/Arch:       linux/arm64



barnoux@srvone4all:~$ podman info
host:
  arch: arm64
  buildahVersion: 1.39.3
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.12-4_arm64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: unknown'
  cpuUtilization:
    idlePercent: 99.18
    systemPercent: 0.21
    userPercent: 0.61
  cpus: 4
  databaseBackend: sqlite
  distribution:
    codename: trixie
    distribution: debian
    version: "13"
  eventLogger: journald
  freeLocks: 2036
  hostname: srvone4all
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.12.57+deb13-arm64
  linkmode: dynamic
  logDriver: journald
  memFree: 60358656
  memTotal: 3025973248
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.14.0-3_arm64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.14.0
    package: netavark_1.14.0-2_arm64
    path: /usr/lib/podman/netavark
    version: netavark 1.14.0
  ociRuntime:
    name: crun
    package: crun_1.21-1_arm64
    path: /usr/bin/crun
    version: |-
      crun version 1.21
      commit: 10269840aa07fb7e6b7e1acff6198692d8ff5c88
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20250503.587980c-2_arm64
    version: ""
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.1-1.1_arm64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.6.0
  swapFree: 4071878656
  swapTotal: 4093636608
  uptime: 164h 5m 56.00s (Approximately 6.83 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  configFile: /home/barnoux/.config/containers/storage.conf
  containerStore:
    number: 5
    paused: 0
    running: 5
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/barnoux/.local/share/containers/storage
  graphRootAllocated: 19974565888
  graphRootUsed: 3894898688
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 20
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/barnoux/.local/share/containers/storage/volumes
version:
  APIVersion: 5.4.2
  BuildOrigin: Debian
  Built: 1753479578
  BuiltTime: Fri Jul 25 23:39:38 2025
  GitCommit: ""
  GoVersion: go1.24.4
  Os: linux
  OsArch: linux/arm64
  Version: 5.4.2

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

No response

Additional information

No response

Source: podman-container-tools/podman

View original on GitHubView discussion on GitHub