From c38fd809baee799675aa76f73a3e34ac0744922d Mon Sep 17 00:00:00 2001
From: Riccardo Paolo Bestetti <pbl@bestov.io>
Date: Thu, 29 Jan 2026 17:08:37 +0100
Subject: [PATCH] set up default IDMappings when none are set and userns=auto

Signed-off-by: Riccardo Paolo Bestetti <pbl@bestov.io>
---
 pkg/specgen/generate/container_create.go | 16 +++++++++++++++
 test/apiv2/20-containers.at              | 25 ++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/pkg/specgen/generate/container_create.go b/pkg/specgen/generate/container_create.go
index 3637b18ae08..d32f25ab789 100644
--- a/pkg/specgen/generate/container_create.go
+++ b/pkg/specgen/generate/container_create.go
@@ -217,6 +217,22 @@ func MakeContainer(ctx context.Context, rt *libpod.Runtime, s *specgen.SpecGener
 		}
 	}
 
+	// if userns is auto, set up annotation, and default IDMappings if none are set
+	if s.UserNS.IsAuto() {
+		if s.Annotations == nil {
+			s.Annotations = make(map[string]string)
+		}
+		s.Annotations[define.UserNsAnnotation] = string(s.UserNS.NSMode)
+
+		if s.IDMappings == nil {
+			mappings, err := util.ParseIDMapping(namespaces.UsernsMode(s.UserNS.NSMode), nil, nil, "", "")
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			s.IDMappings = mappings
+		}
+	}
+
 	if err := s.Validate(); err != nil {
 		return nil, nil, nil, fmt.Errorf("invalid config provided: %w", err)
 	}
diff --git a/test/apiv2/20-containers.at b/test/apiv2/20-containers.at
index daedb4e02fb..5abd6ef030a 100644
--- a/test/apiv2/20-containers.at
+++ b/test/apiv2/20-containers.at
@@ -948,6 +948,31 @@ for runtime in "${oci_runtimes[@]}"; do
     t DELETE containers/$cid 204
 done
 
+# 27988: make sure creation with "userns": {"nsmode": "auto"} works even without
+# explicit idmappings. check for the same behaviour the cmd line shows: when the
+# container is created, UsernsMode is ""; after the container is started,
+# UsernsMode becomes "private"
+
+t POST libpod/containers/create \
+  Image=$IMAGE \
+  UserNS='{"NSMode":"auto"}' \
+  201
+cid=$(jq -r '.Id' <<<"$output")
+
+t GET libpod/containers/$cid/json \
+  200 \
+  .HostConfig.UsernsMode=''
+
+t POST   libpod/containers/$cid/start 204
+
+t GET libpod/containers/$cid/json \
+  200 \
+  .HostConfig.UsernsMode=private
+
+t DELETE libpod/containers/$cid 200 .[0].Id=$cid
+
+
+# clean up
 podman rmi -f $IMAGE
 
 # Test health status in /containers/json (GH #27786)