diff --git a/man/systemd-nspawn.xml b/man/systemd-nspawn.xml
index ea0c6562f88..bd688a0ee19 100644
--- a/man/systemd-nspawn.xml
+++ b/man/systemd-nspawn.xml
@@ -444,7 +444,9 @@
- Equivalent to .
+ If the kernel supports the user namespaces feature, equivalent to
+ , otherwise equivalent to
+ .
diff --git a/src/basic/user-util.h b/src/basic/user-util.h
index c23f1d485d5..8026eca3f47 100644
--- a/src/basic/user-util.h
+++ b/src/basic/user-util.h
@@ -21,6 +21,7 @@
#include
#include
+#include
bool uid_is_valid(uid_t uid);
@@ -63,3 +64,7 @@ int take_etc_passwd_lock(const char *root);
#define PTR_TO_GID(p) ((gid_t) (((uintptr_t) (p))-1))
#define GID_TO_PTR(u) ((void*) (((uintptr_t) (u))+1))
+
+static inline bool userns_supported(void) {
+ return access("/proc/self/uid_map", F_OK) >= 0;
+}
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index 40e3d5a3fe3..c8a7ec71a32 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -866,11 +866,14 @@ static int parse_argv(int argc, char *argv[]) {
break;
case 'U':
- arg_userns_mode = USER_NAMESPACE_PICK;
- arg_uid_shift = UID_INVALID;
- arg_uid_range = UINT32_C(0x10000);
+ if (userns_supported()) {
+ arg_userns_mode = USER_NAMESPACE_PICK;
+ arg_uid_shift = UID_INVALID;
+ arg_uid_range = UINT32_C(0x10000);
+
+ arg_settings_mask |= SETTING_USERNS;
+ }
- arg_settings_mask |= SETTING_USERNS;
break;
case ARG_PRIVATE_USERS_CHOWN:
@@ -990,7 +993,7 @@ static int parse_argv(int argc, char *argv[]) {
return -EINVAL;
}
- if (arg_userns_mode != USER_NAMESPACE_NO && access("/proc/self/uid_map", F_OK) < 0) {
+ if (arg_userns_mode != USER_NAMESPACE_NO && !userns_supported()) {
log_error("--private-users= is not supported, kernel compiled without user namespace support.");
return -EOPNOTSUPP;
}