{"record":{"id":"30bcdeb6d9db3403","repo":"awslabs/llrt","slug":"could-not-create-memfd","errorCode":null,"errorMessage":"Could not create memfd","messagePattern":"Could not create memfd","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"llrt/src/main.c","lineNumber":263,"sourceCode":"\n  *uncompressedData = uncompressed;\n}\n\nint main(int argc, char *argv[])\n{\n  initLoggingFlag();\n\n  logInfo(\"Runtime starting\\n\");\n\n  char *tmpAppname = strrchr(argv[0], '/');\n  char *appname = tmpAppname ? ++tmpAppname : argv[0];\n\n  double t0 = micro_seconds();\n\n  int outputFd = memfd_create_syscall(appname, 0);\n  if (outputFd == -1)\n  {\n    err(1, \"Could not create memfd\");\n  }\n\n  char *uncompressedData;\n  uint32_t uncompressedSize;\n\n  decompress(&uncompressedData, &uncompressedSize, outputFd);\n\n  double t1 = micro_seconds();\n  logInfo(\"Runtime starting\\n\");\n  logInfo(\"Extraction time: %10.4f ms\\n\", (t1 - t0) / 1000.0);\n\n  if (munmap(uncompressedData, uncompressedSize) == -1)\n  {\n    err(1, \"Failed to unmap memory\");\n  }\n\n  double t2 = micro_seconds();\n  logInfo(\"Extraction + write time: %10.4f ms\\n\", (t2 - t0) / 1000.0);","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/awslabs/llrt/blob/742fc00b82cbeaab1c1b76f0d706c302a5cbc306/llrt/src/main.c#L245-L281","documentation":"main() creates an anonymous in-memory file via memfd_create_syscall(appname, 0) to hold the decompressed runtime. This error means the memfd_create syscall returned -1, so there is no output fd to decompress into and the runtime cannot start at all. This is the first step of the self-extraction boot sequence.","triggerScenarios":"memfd_create fails: kernel older than Linux 3.17 (no memfd_create syscall), seccomp/container syscall filter blocks memfd_create (e.g. default Docker seccomp on old profiles, gVisor, some FaaS runtimes), or MFD_* flag restrictions under hardened LSM policies.","commonSituations":"Running llrt inside old-kernel VMs or minimal initrd environments, strict serverless sandboxes (AWS Lambda older runtimes, Cloud Run sandboxes), or hardened Kubernetes pods with restrictive seccomp profiles that omit memfd_create.","solutions":["Run on Linux kernel >= 3.17 where memfd_create exists; upgrade the host kernel.","Relax the container/sandbox seccomp profile to allow memfd_create (e.g. add to the allowed syscall list or use a less restrictive profile).","If seccomp cannot be changed, use a llrt build/variant that falls back to a regular temp file, or run outside the restricted sandbox.","Check LSM (SELinux/AppArmor) denial logs (`dmesg`, auditd) and add an allow rule for memfd_create."],"exampleFix":"// docker run (default seccomp blocks some syscalls on old engines)\n// before\ndocker run llrt-app\n// after\ndocker run --security-opt seccomp=unconfined llrt-app","handlingStrategy":"fallback","validationCode":"// Probe memfd_create availability in the target environment:\nimport { execFileSync } from 'node:child_process';\nfunction memfdSupported() {\n  try {\n    execFileSync('sh', ['-c', 'awk \"/memfd_create/\" /proc/kallsyms >/dev/null 2>&1']);\n    return true;\n  } catch { return false; }\n}\nif (!memfdSupported()) console.warn('memfd may be unavailable — llrt will not start here');","typeGuard":null,"tryCatchPattern":"try {\n  child_process.execFileSync('./llrt', ['app.js']);\n} catch (e) {\n  if (e.status === 1 && /Could not create memfd/.test(String(e.stderr))) {\n    // run on a kernel >= 3.17 or relax the seccomp profile, then retry\n  }\n}","preventionTips":["Require Linux >= 3.17 in your deployment docs/health checks.","Review container seccomp profiles for memfd_create before deploying.","Add a startup health check that executes `llrt -v` and fails fast with a clear message.","Check LSM audit logs when running under SELinux/AppArmor."],"tags":["memfd","syscall","sandbox","kernel"],"backgroundTag":"memfd-create-failed","analyzedSha":"742fc00b82cbeaab1c1b76f0d706c302a5cbc306","analyzedAt":"2026-09-12T11:14:07.838Z","contentChangedAt":"2026-09-12T11:14:07.838Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}