firecracker-microvm/firecracker · error

Failed to set the requested seccomp filters on vCPU {}: Erro

Error message

Failed to set the requested seccomp filters on vCPU {}: Error: {}

What it means

Error "Failed to set the requested seccomp filters on vCPU {}: Error: {}" thrown in firecracker-microvm/firecracker.

Source

Thrown at src/vmm/src/vstate/vcpu.rs:222

        Ok(VcpuHandle::new(
            event_sender,
            response_receiver,
            vcpu_fd,
            vcpu_thread,
        ))
    }

    /// Main loop of the vCPU thread.
    ///
    /// Runs the vCPU in KVM context in a loop. Handles KVM_EXITs then goes back in.
    /// Note that the state of the VCPU and associated VM must be setup first for this to do
    /// anything useful.
    pub fn run(&mut self, seccomp_filter: BpfProgramRef) {
        // Load seccomp filters for this vCPU thread.
        // Execution panics if filters cannot be loaded, use --no-seccomp if skipping filters
        // altogether is the desired behaviour.
        if let Err(err) = crate::seccomp::apply_filter(seccomp_filter) {
            panic!(
                "Failed to set the requested seccomp filters on vCPU {}: Error: {}",
                self.kvm_vcpu.index, err
            );
        }

        // Start running the machine state in the `Paused` state.
        let mut state = VcpuRunState::Paused;
        loop {
            state = match state {
                VcpuRunState::Running => self.running(),
                VcpuRunState::Paused => self.paused(),
                VcpuRunState::Finished => break,
            };
        }
    }

    // This is the main loop of the `Running` state.
    fn running(&mut self) -> VcpuRunState {

View on GitHub (pinned to 81b38b9dad)

Solutions

1. Verify the seccomp filter built for vCPU threads is valid and only permits the syscalls vCPUs need.
2. Confirm the process may install seccomp filters before spawning vCPU threads.

When it happens

Trigger: Thrown at src/vmm/src/vstate/vcpu.rs:222 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of firecracker-microvm/firecracker@81b38b9dad (2026-08-19). Data as JSON: /api/errors/7763a4ebe7af1208. Report an issue: GitHub.