{"record":{"id":"2a2897aa6376ea26","repo":"hashicorp/nomad","slug":"compacting-json-for-seccomp-profile-s-failed","errorCode":null,"errorMessage":"compacting json for seccomp profile (%s) failed: %v","messagePattern":"compacting json for seccomp profile \\((.+?)\\) failed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":924,"sourceCode":"// https://github.com/docker/cli/blob/8ef8547eb6934b28497d309d21e280bcd25145f5/cli/command/container/opts.go#L840\nfunc parseSecurityOpts(securityOpts []string) ([]string, error) {\n\tfor key, opt := range securityOpts {\n\t\tcon := strings.SplitN(opt, \"=\", 2)\n\t\tif len(con) == 1 && con[0] != \"no-new-privileges\" {\n\t\t\tif strings.Contains(opt, \":\") {\n\t\t\t\tcon = strings.SplitN(opt, \":\", 2)\n\t\t\t} else {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"invalid security_opt: %q\", opt)\n\t\t\t}\n\t\t}\n\t\tif con[0] == \"seccomp\" && con[1] != \"unconfined\" {\n\t\t\tf, err := os.ReadFile(con[1])\n\t\t\tif err != nil {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %v\", con[1], err)\n\t\t\t}\n\t\t\tb := bytes.NewBuffer(nil)\n\t\t\tif err := json.Compact(b, f); err != nil {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %v\", con[1], err)\n\t\t\t}\n\t\t\tsecurityOpts[key] = fmt.Sprintf(\"seccomp=%s\", b.Bytes())\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\nconst (\n\t// memoryNoLimit is a sentinel value for memory_max that indicates the\n\t// driver should not enforce a maximum memory limit\n\tmemoryNoLimit = -1\n)\n\n// memoryLimits computes the memory and memory_reservation values passed along\n// to the docker host config. These fields represent hard limit (cgroup\n// memory.max) and memory reservation (cgroup memory.low) from docker's\n// perspective, respectively.","sourceCodeStart":906,"sourceCodeEnd":942,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L906-L942","documentation":"This error is raised in parseSecurityOpts when a docker driver task supplies a `seccomp=<path>` security option pointing to a JSON seccomp profile file. The driver reads the file and compacts (minifies) the JSON before passing it to the Docker daemon; if json.Compact fails, the JSON is malformed. Nomad aborts container creation so the daemon never receives an invalid profile.","triggerScenarios":"Setting security_opt = [\"seccomp=/path/to/profile.json\"] in the task's docker driver config where the file contains invalid JSON (trailing commas, comments, single quotes, truncated file, or non-JSON content).","commonSituations":"Hand-written seccomp profiles with JSON syntax mistakes; profiles copied from tutorials containing comments (JSON has none); a partially-uploaded or empty profile file; generating the profile with a tool that emits JSONC.","solutions":["Validate the profile with `jq . /path/to/profile.json` (or `python -m json.tool`) and fix the reported syntax error.","Remove comments and trailing commas — raw JSON forbids both; use a JSONC-to-JSON converter if the source has comments.","Verify the path in security_opt points to the correct file readable by the Nomad client, and the file is not empty or truncated.","Regenerate the profile from a known-good source, e.g. `docker run --rm alpine seccomp-dump` or moby's default profile, then re-run the task."],"exampleFix":"// task docker config\n// before\nsecurity_opt = [\"seccomp=/etc/nomad/seccomp.json\"]  // file contains // comments\n// after: strip comments / fix syntax so `jq . /etc/nomad/seccomp.json` succeeds, then keep\nsecurity_opt = [\"seccomp=/etc/nomad/seccomp.json\"]","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nfunction validateSeccompProfile(path) {\n  const raw = fs.readFileSync(path, 'utf8');\n  JSON.parse(raw); // throws on invalid JSON, mirroring json.Compact\n  return true;\n}","typeGuard":"function isSeccompOpt(opt) {\n  return typeof opt === 'string' && opt.startsWith('seccomp=');\n}","tryCatchPattern":"try {\n  validateSeccompProfile(profilePath);\n} catch (e) {\n  throw new Error(`seccomp profile ${profilePath} is not valid JSON: ${e.message}`);\n}","preventionTips":["Run `jq . profile.json` as a CI check on every seccomp profile.","Never hand-edit JSON with comments; strip JSONC before deploying.","Checksum profiles and verify after distribution to clients."],"tags":["docker","seccomp","json","config"],"backgroundTag":"invalid-json-profile","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}