firecracker-microvm/firecracker · error

Failed to set the requested seccomp filters on the API threa

Error message

Failed to set the requested seccomp filters on the API thread: {}

What it means

Error "Failed to set the requested seccomp filters on the API thread: {}" thrown in firecracker-microvm/firecracker.

Source

Thrown at src/firecracker/src/api_server/mod.rs:78

    /// * `path` - the socket path on which the server will wait for requests.
    /// * `start_time_us` - the timestamp for when the process was started in us.
    /// * `start_time_cpu_us` - the timestamp for when the process was started in CPU us.
    /// * `seccomp_filter` - the seccomp filter to apply.
    pub fn run(
        &mut self,
        mut server: HttpServer,
        process_time_reporter: ProcessTimeReporter,
        seccomp_filter: BpfProgramRef,
        api_payload_limit: usize,
    ) {
        // Set the api payload size limit.
        server.set_payload_max_size(api_payload_limit);

        // Load seccomp filters on the API thread.
        // Execution panics if filters cannot be loaded, use --no-seccomp if skipping filters
        // altogether is the desired behaviour.
        if let Err(err) = vmm::seccomp::apply_filter(seccomp_filter) {
            panic!(
                "Failed to set the requested seccomp filters on the API thread: {}",
                err
            );
        }

        server.start_server().expect("Cannot start HTTP server");
        info_unrestricted!("API server started.");

        // Store process start time metric.
        process_time_reporter.report_start_time();
        // Store process CPU start time metric.
        process_time_reporter.report_cpu_start_time();

        loop {
            let request_vec = match server.requests() {
                Ok(vec) => vec,
                Err(ServerError::ShutdownEvent) => {
                    server.flush_outgoing_writes();

View on GitHub (pinned to cc535f035f)

Solutions

1. Verify the seccomp filter supplied to the API thread is valid BPF and covers exactly the syscalls the API server uses.
2. Confirm the process may install seccomp filters (no_new_privs set or CAP_SYS_ADMIN) and check audit logs for the failing syscall.

When it happens

Trigger: Thrown at src/firecracker/src/api_server/mod.rs:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of firecracker-microvm/firecracker@cc535f035f (2026-08-19). Data as JSON: /api/errors/d6f0bab2cb7131c0. Report an issue: GitHub.