{"record":{"id":"1fe3fd8ad627f38c","repo":"docker/cli","slug":"opening-seccomp-profile-s-failed-w","errorCode":null,"errorMessage":"opening seccomp profile (%s) failed: %w","messagePattern":"opening seccomp profile \\((.+?)\\) failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":948,"sourceCode":"\tfor key, opt := range securityOpts {\n\t\tk, v, ok := strings.Cut(opt, \"=\")\n\t\tif !ok && k != \"no-new-privileges\" {\n\t\t\tk, v, ok = strings.Cut(opt, \":\")\n\t\t}\n\t\tif (!ok || v == \"\") && k != \"no-new-privileges\" {\n\t\t\t// \"no-new-privileges\" is the only option that does not require a value.\n\t\t\treturn securityOpts, fmt.Errorf(\"invalid --security-opt: %q\", opt)\n\t\t}\n\t\tif k == \"seccomp\" {\n\t\t\tswitch v {\n\t\t\tcase seccompProfileDefault, seccompProfileUnconfined:\n\t\t\t\t// known special names for built-in profiles, nothing to do.\n\t\t\tdefault:\n\t\t\t\t// value may be a filename, in which case we send the profile's\n\t\t\t\t// content if it's valid JSON.\n\t\t\t\tf, err := os.ReadFile(v)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tvar b bytes.Buffer\n\t\t\t\tif err := json.Compact(&b, f); err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tsecurityOpts[key] = \"seccomp=\" + b.String()\n\t\t\t}\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\n// parseSystemPaths checks if `systempaths=unconfined` security option is set,\n// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated\n// list of security options is returned with this option removed, because the\n// `unconfined` option is handled client-side, and should not be sent to the\n// daemon.","sourceCodeStart":930,"sourceCodeEnd":966,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L930-L966","documentation":"Thrown by parseSecurityOpts when seccomp=<filename> is used and os.ReadFile cannot read that file. The CLI reads the local seccomp profile file to send its JSON content to the daemon, so the file must exist and be readable by the user running docker.","triggerScenarios":"Calling `docker run --security-opt seccomp=/path/to/profile.json` where the path does not exist, is a directory, or the invoking user lacks read permission. os.ReadFile returns an os.PathError wrapped into this error.","commonSituations":"Relative path that resolves against an unexpected working directory; profile deleted/moved; SELinux/AppArmor blocking access; misspelled path; running docker via sudo where the file is only readable by the non-root user.","solutions":["Verify the path exists and is a file: ls -l /path/to/profile.json","Use an absolute path to avoid working-directory ambiguity","Fix permissions so the user invoking docker can read it (chmod +r or adjust ownership)","If the file is under a restricted home dir and you run via sudo, copy it to a world-readable location"],"exampleFix":"# before\ndocker run --security-opt seccomp=~/profiles/custom.json ...\n# after\ndocker run --security-opt seccomp=/home/user/profiles/custom.json ...","handlingStrategy":"validation","validationCode":"// Ensure the seccomp profile file is readable before invoking docker.\nprofile := \"/path/to/profile.json\"\ninfo, err := os.Stat(profile)\nif err != nil || info.IsDir() {\n    return fmt.Errorf(\"seccomp profile not readable: %w\", err)\n}\n// optional: attempt a read to confirm permissions\nif _, err := os.ReadFile(profile); err != nil {\n    return err\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass absolute paths for seccomp profiles","In CI, assert the profile file exists as a build step before the docker run","Store profiles in a version-controlled, world-readable location"],"tags":["docker","seccomp","filesystem","permissions"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}