{"record":{"id":"3d2e993b99d510f5","repo":"docker/cli","slug":"compacting-json-for-seccomp-profile-s-failed","errorCode":null,"errorMessage":"compacting json for seccomp profile (%s) failed: %w","messagePattern":"compacting json for seccomp profile \\((.+?)\\) failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":952,"sourceCode":"\t\t}\n\t\tif (!ok || v == \"\") && k != \"no-new-privileges\" {\n\t\t\t// \"no-new-privileges\" is the only option that does not require a value.\n\t\t\treturn securityOpts, fmt.Errorf(\"invalid --security-opt: %q\", opt)\n\t\t}\n\t\tif k == \"seccomp\" {\n\t\t\tswitch v {\n\t\t\tcase seccompProfileDefault, seccompProfileUnconfined:\n\t\t\t\t// known special names for built-in profiles, nothing to do.\n\t\t\tdefault:\n\t\t\t\t// value may be a filename, in which case we send the profile's\n\t\t\t\t// content if it's valid JSON.\n\t\t\t\tf, err := os.ReadFile(v)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tvar b bytes.Buffer\n\t\t\t\tif err := json.Compact(&b, f); err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tsecurityOpts[key] = \"seccomp=\" + b.String()\n\t\t\t}\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\n// parseSystemPaths checks if `systempaths=unconfined` security option is set,\n// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated\n// list of security options is returned with this option removed, because the\n// `unconfined` option is handled client-side, and should not be sent to the\n// daemon.\nfunc parseSystemPaths(securityOpts []string) (filtered, maskedPaths, readonlyPaths []string) {\n\tfiltered = securityOpts[:0]\n\tfor _, opt := range securityOpts {\n\t\tif opt == \"systempaths=unconfined\" {","sourceCodeStart":934,"sourceCodeEnd":970,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L934-L970","documentation":"Thrown by parseSecurityOpts after successfully reading a seccomp profile file when json.Compact fails, meaning the file content is not valid JSON. The CLI compacts the JSON before embedding it inline in the security option sent to the daemon.","triggerScenarios":"Calling `docker run --security-opt seccomp=/path/to/profile.json` where the file is readable but contains syntax errors (trailing commas, comments, unquoted keys, truncated content, or non-JSON like YAML/INI).","commonSituations":"Hand-editing the profile and leaving a syntax error; saving the file in a different format; CRLF/encoding issues; copying a profile snippet that was incomplete; profile generated by a tool that emits YAML.","solutions":["Validate the JSON with a parser: jq . /path/to/profile.json","Start from the default profile (docker default seccomp profile) and modify incrementally","Remove JSON comments (not valid in strict JSON) and trailing commas","Re-save the file as UTF-8 without BOM"],"exampleFix":"# before (profile.json contains a comment)\n{\n  // seccomp rules\n  \"defaultAction\": \"SCMP_ACT_ERRNO\"\n}\n# after\n{\n  \"defaultAction\": \"SCMP_ACT_ERRNO\"\n}","handlingStrategy":"validation","validationCode":"// Validate JSON content of a seccomp profile before passing it to docker.\nfunc validSeccompJSON(path string) error {\n    b, err := os.ReadFile(path)\n    if err != nil {\n        return err\n    }\n    var v any\n    return json.Unmarshal(b, &v)\n}\n\nif err := validSeccompJSON(profile); err != nil {\n    return fmt.Errorf(\"seccomp profile not valid JSON: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Lint profiles with jq as a pre-commit hook","Generate profiles programmatically with encoding/json rather than hand-editing"],"tags":["docker","seccomp","json","config-validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}