{"record":{"id":"b5d453ca502498ec","repo":"hashicorp/nomad","slug":"opening-seccomp-profile-s-failed-v","errorCode":null,"errorMessage":"opening seccomp profile (%s) failed: %v","messagePattern":"opening seccomp profile \\((.+?)\\) failed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/driver.go","lineNumber":920,"sourceCode":"}\n\n// takes a local seccomp daemon, reads the file contents for sending to the daemon\n// this code modified slightly from the docker CLI code\n// https://github.com/docker/cli/blob/8ef8547eb6934b28497d309d21e280bcd25145f5/cli/command/container/opts.go#L840\nfunc parseSecurityOpts(securityOpts []string) ([]string, error) {\n\tfor key, opt := range securityOpts {\n\t\tcon := strings.SplitN(opt, \"=\", 2)\n\t\tif len(con) == 1 && con[0] != \"no-new-privileges\" {\n\t\t\tif strings.Contains(opt, \":\") {\n\t\t\t\tcon = strings.SplitN(opt, \":\", 2)\n\t\t\t} else {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"invalid security_opt: %q\", opt)\n\t\t\t}\n\t\t}\n\t\tif con[0] == \"seccomp\" && con[1] != \"unconfined\" {\n\t\t\tf, err := os.ReadFile(con[1])\n\t\t\tif err != nil {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"opening seccomp profile (%s) failed: %v\", con[1], err)\n\t\t\t}\n\t\t\tb := bytes.NewBuffer(nil)\n\t\t\tif err := json.Compact(b, f); err != nil {\n\t\t\t\treturn securityOpts, fmt.Errorf(\"compacting json for seccomp profile (%s) failed: %v\", con[1], err)\n\t\t\t}\n\t\t\tsecurityOpts[key] = fmt.Sprintf(\"seccomp=%s\", b.Bytes())\n\t\t}\n\t}\n\n\treturn securityOpts, nil\n}\n\nconst (\n\t// memoryNoLimit is a sentinel value for memory_max that indicates the\n\t// driver should not enforce a maximum memory limit\n\tmemoryNoLimit = -1\n)\n","sourceCodeStart":902,"sourceCodeEnd":938,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/driver.go#L902-L938","documentation":"When a security_opt entry is seccomp=<profile> (other than 'unconfined'), parseSecurityOpts reads the profile file from disk and compacts its JSON before passing it to Docker. This error means os.ReadFile of the seccomp profile path failed — the file is missing, unreadable, or the path is wrong. It surfaces the errno in %v.","triggerScenarios":"config.security_opt has \"seccomp=/path/to/profile.json\" but the file does not exist on the Nomad client, the task lacks read permission, or a relative path resolves against the wrong working directory. Raised in createContainerConfig.","commonSituations":"Seccomp profile not shipped to the client node (only present in the job dir, not at the absolute path used), typo in the path, permissions tightened by hardening, or referencing a profile inside the container image (unavailable on host).","solutions":["Ensure the seccomp profile file exists on the client host at the exact absolute path given.","Distribute the profile via provisioning (or a template/artifact to a known client path) and reference that path.","Check file permissions so the Nomad agent user can read it.","If no custom profile is needed, use \"seccomp=unconfined\" (not recommended) or drop the option to use Docker's default."],"exampleFix":"// before\nconfig { security_opt = [\"seccomp=./profile.json\"] }\n// after\nconfig { security_opt = [\"seccomp=/etc/nomad.d/seccomp/profile.json\"] }","handlingStrategy":"validation","validationCode":"for _, opt := range cfg.SecurityOpt {\n\tif strings.HasPrefix(opt, \"seccomp=\") && !strings.HasSuffix(opt, \"unconfined\") {\n\t\tpath := strings.TrimPrefix(opt, \"seccomp=\")\n\t\tif _, err := os.ReadFile(path); err != nil {\n\t\t\treturn fmt.Errorf(\"seccomp profile %s unreadable: %w\", path, err)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"if _, err := os.ReadFile(path); err != nil {\n\tif os.IsNotExist(err) {\n\t\treturn fmt.Errorf(\"seccomp profile missing on client: %s\", path)\n\t}\n\treturn fmt.Errorf(\"cannot read seccomp profile: %w\", err)\n}","preventionTips":["Provision seccomp profiles to every client node at a fixed absolute path","Validate the profile is readable by the Nomad agent user","Profiles live on the host, not inside the container image — never reference image paths","Test JSON validity of the profile at deploy time"],"tags":["docker","security","seccomp","filesystem"],"backgroundTag":"file-not-found","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}