How to fix Error response from daemon: error loading seccomp profile in Docker

First, check that your kernel has seccomp enabled:

grep CONFIG_SECCOMP /boot/config-$(uname -r)

You should see:

CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y

If not present, you'll need a kernel with seccomp support, or you must disable seccomp entirely.

If you're using a custom profile, verify the file exists:

ls -la /path/to/your/seccomp-profile.json

Ensure Docker can read it:

# Check permissions
stat /path/to/your/seccomp-profile.json

# Test JSON validity
cat /path/to/your/seccomp-profile.json | python3 -m json.tool

If the JSON validation fails, you have a syntax error in the profile.

If you don't need a custom profile, use Docker's default:

For container runs:

# Default profile is applied automatically when no option specified
docker run --rm hello-world

To explicitly use the default in daemon.json:
Download the default profile from the official repository:

curl -o /etc/docker/default-seccomp.json \
  https://raw.githubusercontent.com/moby/moby/master/profiles/seccomp/default.json

Then configure the daemon:

{
  "seccomp-profile": "/etc/docker/default-seccomp.json"
}

To bypass seccomp temporarily for debugging:

docker run --rm -it --security-opt seccomp=unconfined ubuntu:latest

Warning: Running without seccomp removes an important security layer. Only use this for testing, never in production.

In Docker Compose:

services:
  myapp:
    image: myimage
    security_opt:
      - seccomp:unconfined

A common error on older kernels involves the clone3 syscall:

error adding seccomp filter rule for syscall clone3: permission denied

This happens with Docker 20.10+ on older kernels. To fix:

Option 1: Update your kernel (recommended)

# Ubuntu/Debian
sudo apt update && sudo apt upgrade

# After kernel upgrade, reboot
sudo reboot

Option 2: Use a modified profile without clone3
Download and modify the default profile to remove clone3 references, or use an older compatible profile.

After fixing the issue, verify seccomp is properly applied:

# Check Docker's security options
docker info --format '{{ .SecurityOptions }}'

You should see seccomp in the output.

Check seccomp status inside a container:

docker run --rm alpine grep Seccomp /proc/1/status

- Seccomp: 2 means seccomp filter is active (secure)
- Seccomp: 0 means no seccomp profile applied (unconfined)

If you modified daemon.json or updated kernel, restart Docker:

# Restart Docker daemon
sudo systemctl restart docker

# Verify it started correctly
sudo systemctl status docker

# Check for seccomp-related errors in logs
sudo journalctl -u docker -n 50 | grep -i seccomp

If the daemon fails to start, check the seccomp profile path in your daemon.json is correct.