docker/compose · error

opening seccomp profile

Error message

opening seccomp profile (%s) failed: %w

What it means

Error "opening seccomp profile (%s) failed: %w" thrown in docker/compose.

Solutions

1. Check that the seccomp profile path exists and is readable on the host running the command.
2. Use an absolute path or a path relative to the project directory, and fix file permissions.

When it happens

Trigger: A seccomp profile referenced via security_opt (seccomp=<path>) could not be opened or read from the local filesystem.

Common situations: The profile file path is wrong, the file does not exist, or permissions prevent reading it.

AI-assisted analysis of docker/compose@ddc4b044b6 (2026-08-15). Data as JSON: /api/errors/6e2a2814e5a07d71. Report an issue: GitHub.

Appendix: source

Thrown at pkg/compose/create.go:577

		parsed     []string
	)
	for _, opt := range securityOpts {
		if opt == "systempaths=unconfined" {
			unconfined = true
			continue
		}
		con := strings.SplitN(opt, "=", 2)
		if len(con) == 1 && con[0] != "no-new-privileges" {
			if strings.Contains(opt, ":") {
				con = strings.SplitN(opt, ":", 2)
			} else {
				return securityOpts, false, fmt.Errorf("invalid security-opt: %q", opt)
			}
		}
		if con[0] == "seccomp" && con[1] != "unconfined" && con[1] != "builtin" {
			f, err := os.ReadFile(p.RelativePath(con[1]))
			if err != nil {
				return securityOpts, false, fmt.Errorf("opening seccomp profile (%s) failed: %w", con[1], err)
			}
			b := bytes.NewBuffer(nil)
			if err := json.Compact(b, f); err != nil {
				return securityOpts, false, fmt.Errorf("compacting json for seccomp profile (%s) failed: %w", con[1], err)
			}
			parsed = append(parsed, fmt.Sprintf("seccomp=%s", b.Bytes()))
		} else {
			parsed = append(parsed, opt)
		}
	}

	return parsed, unconfined, nil
}

// defaultNetworkSettings determines the container.NetworkMode and corresponding network.NetworkingConfig (nil if not applicable).
func defaultNetworkSettings(project *types.Project,
	service types.ServiceConfig, serviceIndex int,
	links []string, useNetworkAliases bool,

View on GitHub (pinned to ddc4b044b6)