{"record":{"id":"68dcb133e318102c","repo":"nektos/act","slug":"opening-seccomp-profile-s-failed-w","errorCode":null,"errorMessage":"opening seccomp profile (%s) failed: %w","messagePattern":"opening seccomp profile \\((.+?)\\) failed: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/container/docker_cli.go","lineNumber":955,"sourceCode":"\tfor key, opt := range securityOpts {\n\t\tk, v, ok := strings.Cut(opt, \"=\")\n\t\tif !ok && k != \"no-new-privileges\" {\n\t\t\tk, v, ok = strings.Cut(opt, \":\")\n\t\t}\n\t\tif (!ok || v == \"\") && k != \"no-new-privileges\" {\n\t\t\t// \"no-new-privileges\" is the only option that does not require a value.\n\t\t\treturn securityOpts, fmt.Errorf(\"invalid --security-opt: %q\", opt)\n\t\t}\n\t\tif k == \"seccomp\" {\n\t\t\tswitch v {\n\t\t\tcase seccompProfileDefault, seccompProfileUnconfined:\n\t\t\t\t// known special names for built-in profiles, nothing to do.\n\t\t\tdefault:\n\t\t\t\t// value may be a filename, in which case we send the profile's\n\t\t\t\t// content if it's valid JSON.\n\t\t\t\tf, err := os.ReadFile(v)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tvar b bytes.Buffer\n\t\t\t\tif err := json.Compact(&b, f); err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tsecurityOpts[key] = \"seccomp=\" + b.String()\n\t\t\t}\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\n// parseSystemPaths checks if `systempaths=unconfined` security option is set,\n// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated\n// list of security options is returned with this option removed, because the\n// `unconfined` option is handled client-side, and should not be sent to the\n// daemon.","sourceCodeStart":937,"sourceCodeEnd":973,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/container/docker_cli.go#L937-L973","documentation":"For --security-opt seccomp=<file> where <file> is not the built-in 'default'/'unconfined' names, act reads the file locally and sends its (compacted JSON) contents to the daemon. This error means os.ReadFile on the profile path failed — the file does not exist at that path, or is not readable by the act process. The path is resolved on the host running act, not inside the container.","triggerScenarios":"Passing --security-opt seccomp=/path/to/profile.json where the path is missing, relative to a different working directory, permission-denied, or intended to live inside the container image instead of on the host.","commonSituations":"Workflow authored for real GitHub Actions runners where the profile ships in the repo but act runs on a different machine/cwd; relative paths breaking when act's cwd differs; profiles referenced by container-absolute paths like /etc/docker/seccomp.json that don't exist on the host.","solutions":["Point at an absolute host path that exists and is readable: --security-opt seccomp=$PWD/seccomp.json","Verify with ls on the host running act, not inside the image","If you just want Docker's default behavior, use seccomp=default or drop the flag","Fix file permissions if unreadable (chmod a+r)"],"exampleFix":"# before (path relative to container/ci)\noptions: --security-opt seccomp=etc/seccomp/profile.json\n\n# after (absolute host path)\noptions: --security-opt seccomp=/home/me/project/etc/seccomp/profile.json","handlingStrategy":"validation","validationCode":"// resolve and check the profile on the HOST before passing the option\nif k == \"seccomp\" && !isBuiltinSeccompName(v) {\n    if _, err := os.Stat(v); err != nil {\n        return fmt.Errorf(\"seccomp profile %s not readable on host: %w\", v, err)\n    }\n    if data, err := os.ReadFile(v); err == nil {\n        if !json.Valid(data) { return fmt.Errorf(\"profile %s is not valid JSON\", v) }\n    }\n}","typeGuard":null,"tryCatchPattern":"f, err := os.ReadFile(v)\nif err != nil {\n    return fmt.Errorf(\"seccomp profile %q unreadable (must exist on the act host): %w\", v, err)\n}","preventionTips":["Use absolute host paths for seccomp profiles","Remember act resolves paths where act runs, not inside the container image","Use seccomp=unconfined or default when no custom profile file is available"],"tags":["docker","security","seccomp","filesystem","act"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}