elastic/elasticsearch · warning · UnsupportedOperationException

seccomp unavailable: '{}' architecture unsupported

Error message

seccomp unavailable: '{}' architecture unsupported

What it means

tryInstallExecSandbox reads os.arch and looks it up in the ARCHITECTURES map, which only contains amd64 and aarch64. If the running JVM reports any other architecture, seccomp-based exec filtering cannot be installed and the method bails out immediately with this UnsupportedOperationException. The check is on architecture, not kernel version, because features can be backported.

Source

Thrown at libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java:172

     * <p>
     * Linux BPF filters will return {@code EACCES} (Access Denied) for the following system calls:
     * <ul>
     *   <li>{@code execve}</li>
     *   <li>{@code fork}</li>
     *   <li>{@code vfork}</li>
     *   <li>{@code execveat}</li>
     * </ul>
     * @see <a href="http://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt">
     *  *      http://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt</a>
     */
    @Override
    public void tryInstallExecSandbox() {
        // first be defensive: we can give nice errors this way, at the very least.
        // also, some of these security features get backported to old versions, checking kernel version here is a big no-no!
        String archId = System.getProperty("os.arch");
        final Arch arch = ARCHITECTURES.get(archId);
        if (arch == null) {
            throw new UnsupportedOperationException("seccomp unavailable: '" + archId + "' architecture unsupported");
        }

        // try to check system calls really are who they claim
        // you never know (e.g. https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/linux/seccomp-bpf/sandbox_bpf.cc#57)
        final int bogusArg = 0xf7a46a5c;

        // test seccomp(BOGUS)
        long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);
        if (ret != -1) {
            throw new UnsupportedOperationException("seccomp unavailable: seccomp(BOGUS_OPERATION) returned " + ret);
        } else {
            int errno = libc.errno();
            switch (errno) {
                case ENOSYS:
                    break; // ok
                case EINVAL:
                    break; // ok
                default:

View on GitHub (pinned to db6a809a66)

Solutions

1. Run Elasticsearch on an amd64 (x86-64) or aarch64 (ARM64) host.
2. If on 64-bit hardware, ensure a 64-bit JVM is used so os.arch reports amd64/aarch64 rather than a 32-bit value.
3. If the architecture genuinely cannot change, accept that the exec sandbox is unavailable; Elasticsearch will continue without it (the throw is logged, not fatal to startup unless the sandbox is hard-required).

String arch = System.getProperty("os.arch");
if (!"amd64".equals(arch) && !"aarch64".equals(arch)) {
    // exec sandbox not available; decide whether to proceed without it
    logger.warn("Exec sandbox unsupported on architecture {}", arch);
}

static boolean isSeccompSupportedArch() {
    String arch = System.getProperty("os.arch");
    return "amd64".equals(arch) || "aarch64".equals(arch);
}

try {
    nativeAccess.tryInstallExecSandbox();
} catch (UnsupportedOperationException e) {
    // sandbox optional; log and continue, or fail hard if policy requires it
    logger.warn("Could not install exec sandbox: {}", e.getMessage());
}

When it happens

Trigger: Invoking LinuxNativeAccess.tryInstallExecSandbox() on a JVM whose System.getProperty("os.arch") is neither amd64 nor aarch64 (e.g. x86, arm, ppc64le, s390x, riscv64). This is called during Elasticsearch bootstrap on Linux when the exec sandbox is enabled.

Common situations: Running Elasticsearch on older/unsupported CPU architectures. Using a 32-bit JVM on a 64-bit host where os.arch reports 'x86' or 'arm'. Containers on uncommon architectures. The message echoes the exact os.arch value for diagnosis.

Related errors

• seccomp unavailable: seccomp(BOGUS_OPERATION) returned {}
• seccomp(BOGUS_OPERATION): {}
• seccomp unavailable: seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_
• seccomp(SECCOMP_SET_MODE_FILTER, BOGUS_FLAG): {}
• seccomp unavailable: prctl(BOGUS_OPTION) returned {}

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/1d419464537cf02c. Report an issue: GitHub.