{"record":{"id":"92233a5b9ea7bce3","repo":"nektos/act","slug":"compacting-json-for-seccomp-profile-s-failed","errorCode":null,"errorMessage":"compacting json for seccomp profile (%s) failed: %w","messagePattern":"compacting json for seccomp profile \\((.+?)\\) failed: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/container/docker_cli.go","lineNumber":959,"sourceCode":"\t\t}\n\t\tif (!ok || v == \"\") && k != \"no-new-privileges\" {\n\t\t\t// \"no-new-privileges\" is the only option that does not require a value.\n\t\t\treturn securityOpts, fmt.Errorf(\"invalid --security-opt: %q\", opt)\n\t\t}\n\t\tif k == \"seccomp\" {\n\t\t\tswitch v {\n\t\t\tcase seccompProfileDefault, seccompProfileUnconfined:\n\t\t\t\t// known special names for built-in profiles, nothing to do.\n\t\t\tdefault:\n\t\t\t\t// value may be a filename, in which case we send the profile's\n\t\t\t\t// content if it's valid JSON.\n\t\t\t\tf, err := os.ReadFile(v)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tvar b bytes.Buffer\n\t\t\t\tif err := json.Compact(&b, f); err != nil {\n\t\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %w\", v, err)\n\t\t\t\t}\n\t\t\t\tsecurityOpts[key] = \"seccomp=\" + b.String()\n\t\t\t}\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\n// parseSystemPaths checks if `systempaths=unconfined` security option is set,\n// and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated\n// list of security options is returned with this option removed, because the\n// `unconfined` option is handled client-side, and should not be sent to the\n// daemon.\nfunc parseSystemPaths(securityOpts []string) (filtered, maskedPaths, readonlyPaths []string) {\n\tfiltered = securityOpts[:0]\n\tfor _, opt := range securityOpts {\n\t\tif opt == \"systempaths=unconfined\" {","sourceCodeStart":941,"sourceCodeEnd":977,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/container/docker_cli.go#L941-L977","documentation":"Thrown while converting a seccomp profile security option for a container. act supports the special values 'unconfined' and 'default'; any other value is treated as a path to a file containing the seccomp profile JSON, which is read and compacted with json.Compact before being passed to Docker. This error means the file was read successfully but its content is not valid JSON, so json.Compact failed.","triggerScenarios":"Setting the container option --security-opt seccomp=<path> where <path> is neither 'default' nor 'unconfined', and the referenced file exists but contains malformed JSON (truncated profile, YAML instead of JSON, HTML error page, BOM, or comments).","commonSituations":"User points seccomp at a Docker/OCI profile downloaded partially, edited by hand, saved as YAML, or references a file with a UTF-8 BOM. Also happens when the path accidentally resolves to a directory or non-profile file that is still readable.","solutions":["Validate the profile file with a JSON parser: jq . /path/to/profile.json or python -m json.tool","Re-download or regenerate the seccomp profile from a trusted source (e.g. moby/default-seccomp.json)","Use the built-in values --security-opt seccomp=unconfined or seccomp=default if a custom profile is not required","Ensure the path is to a regular file containing the raw JSON profile, not YAML or a wrapper script"],"exampleFix":"# before\n--security-opt seccomp=./my-profile.yaml\n\n# after\n--security-opt seccomp=./my-profile.json  # jq . my-profile.json must succeed","handlingStrategy":"validation","validationCode":"# shell, before running act\nf=$(printf '%s' \"$opts\" | grep -oP '(?<=seccomp=)\\S+' || true)\n[ -n \"$f\" ] && [ \"${f##*/}\" != \"unconfined\" ] && [ \"${f##*/}\" != \"default\" ] && jq empty \"$f\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep seccomp profiles in JSON (not YAML) and lint them with jq in CI","Generate profiles from trusted sources instead of hand-editing","Never point seccomp= at a URL or directory"],"tags":["docker","seccomp","security-opt","json","container-options"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}