awslabs/llrt · critical

Could not create memfd

Error message

Could not create memfd

What it means

main() creates an anonymous in-memory file via memfd_create_syscall(appname, 0) to hold the decompressed runtime. This error means the memfd_create syscall returned -1, so there is no output fd to decompress into and the runtime cannot start at all. This is the first step of the self-extraction boot sequence.

Solutions

1. Run on Linux kernel >= 3.17 where memfd_create exists; upgrade the host kernel.
2. Relax the container/sandbox seccomp profile to allow memfd_create (e.g. add to the allowed syscall list or use a less restrictive profile).
3. If seccomp cannot be changed, use a llrt build/variant that falls back to a regular temp file, or run outside the restricted sandbox.
4. Check LSM (SELinux/AppArmor) denial logs (`dmesg`, auditd) and add an allow rule for memfd_create.

Example fix

// docker run (default seccomp blocks some syscalls on old engines)
// before
docker run llrt-app
// after
docker run --security-opt seccomp=unconfined llrt-app

// Probe memfd_create availability in the target environment:
import { execFileSync } from 'node:child_process';
function memfdSupported() {
  try {
    execFileSync('sh', ['-c', 'awk "/memfd_create/" /proc/kallsyms >/dev/null 2>&1']);
    return true;
  } catch { return false; }
}
if (!memfdSupported()) console.warn('memfd may be unavailable — llrt will not start here');

try {
  child_process.execFileSync('./llrt', ['app.js']);
} catch (e) {
  if (e.status === 1 && /Could not create memfd/.test(String(e.stderr))) {
    // run on a kernel >= 3.17 or relax the seccomp profile, then retry
  }
}

When it happens

Trigger: memfd_create fails: kernel older than Linux 3.17 (no memfd_create syscall), seccomp/container syscall filter blocks memfd_create (e.g. default Docker seccomp on old profiles, gVisor, some FaaS runtimes), or MFD_* flag restrictions under hardened LSM policies.

Common situations: Running llrt inside old-kernel VMs or minimal initrd environments, strict serverless sandboxes (AWS Lambda older runtimes, Cloud Run sandboxes), or hardened Kubernetes pods with restrictive seccomp profiles that omit memfd_create.

Related errors

• Failed to set file size
• fexecve failed

AI-assisted analysis of awslabs/llrt@742fc00b82 (2026-09-12). Data as JSON: /api/errors/30bcdeb6d9db3403. Report an issue: GitHub.

Appendix: source

Thrown at llrt/src/main.c:263

  *uncompressedData = uncompressed;
}

int main(int argc, char *argv[])
{
  initLoggingFlag();

  logInfo("Runtime starting\n");

  char *tmpAppname = strrchr(argv[0], '/');
  char *appname = tmpAppname ? ++tmpAppname : argv[0];

  double t0 = micro_seconds();

  int outputFd = memfd_create_syscall(appname, 0);
  if (outputFd == -1)
  {
    err(1, "Could not create memfd");
  }

  char *uncompressedData;
  uint32_t uncompressedSize;

  decompress(&uncompressedData, &uncompressedSize, outputFd);

  double t1 = micro_seconds();
  logInfo("Runtime starting\n");
  logInfo("Extraction time: %10.4f ms\n", (t1 - t0) / 1000.0);

  if (munmap(uncompressedData, uncompressedSize) == -1)
  {
    err(1, "Failed to unmap memory");
  }

  double t2 = micro_seconds();
  logInfo("Extraction + write time: %10.4f ms\n", (t2 - t0) / 1000.0);

View on GitHub (pinned to 742fc00b82)