How to fix Error response from daemon: error loading seccomp profile in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 309 views

This error occurs when Docker cannot load or parse a seccomp security profile. The issue is typically caused by an invalid JSON profile file, incorrect file path, or kernel incompatibility. Fixes include verifying the profile syntax, using the default profile, or temporarily disabling seccomp.

Quick fix

Fixes Error response from daemon: error loading seccomp profile

grep CONFIG_SECCOMP /boot/config-$(uname -r)
  1. Verify your kernel supports seccomp
  2. Check if the profile file exists and is readable
  3. Use Docker's default seccomp profile
  4. Run container without seccomp (testing only)
docker — error
grep CONFIG_SECCOMP /boot/config-$(uname -r)
Error response from daemon: error loading seccomp profile

What this error means

Seccomp (Secure Computing Mode) is a Linux kernel feature that restricts system calls available to containers, providing an additional layer of security. Docker uses seccomp profiles to define which syscalls are allowed or denied inside containers. When you see "error loading seccomp profile," the Docker daemon is unable to parse or apply the seccomp profile specified either in the daemon configuration or via the `--security-opt` flag. This can happen during container startup, image builds, or when starting the Docker daemon itself. The error typically falls into one of these categories: - **Profile not found**: The specified profile file path doesn't exist - **Invalid JSON syntax**: The profile file has malformed JSON - **Unsupported syscalls**: The profile references syscalls not available on your kernel version - **Kernel incompatibility**: The kernel doesn't support the seccomp features required by the profile

Typical symptoms

  • Containers fail to start with 'error loading seccomp profile' message
  • Docker build commands fail when applying security options
  • Docker daemon fails to start after configuring a custom seccomp profile
  • Error message mentions 'OCI runtime create failed' along with seccomp
  • Specific syscalls mentioned in error (e.g., clone3, keyctl)
  • Warning about daemon not using the default seccomp profile

Common causes

  1. The seccomp profile JSON file has syntax errors or is malformed
  2. The profile file path specified doesn't exist or is inaccessible
  3. The profile references syscalls not supported by the kernel version
  4. Docker version mismatch with profile format (older profiles on newer Docker)
  5. Kernel was recently upgraded but system not rebooted
  6. The profile uses an incompatible architecture specification
  7. SELinux or AppArmor interfering with seccomp configuration
  8. Corrupted or incomplete profile file

How to fix "Error response from daemon: error loading seccomp profile"

1Verify your kernel supports seccomp

First, check that your kernel has seccomp enabled:

bash
grep CONFIG_SECCOMP /boot/config-$(uname -r)

You should see:

bash
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y

If not present, you'll need a kernel with seccomp support, or you must disable seccomp entirely.

2Check if the profile file exists and is readable

If you're using a custom profile, verify the file exists:

bash
ls -la /path/to/your/seccomp-profile.json

Ensure Docker can read it:

bash
# Check permissions
stat /path/to/your/seccomp-profile.json

# Test JSON validity
cat /path/to/your/seccomp-profile.json | python3 -m json.tool

If the JSON validation fails, you have a syntax error in the profile.

3Use Docker's default seccomp profile

If you don't need a custom profile, use Docker's default:

For container runs:

bash
# Default profile is applied automatically when no option specified
docker run --rm hello-world

To explicitly use the default in daemon.json:
Download the default profile from the official repository:

bash
curl -o /etc/docker/default-seccomp.json \
  https://raw.githubusercontent.com/moby/moby/master/profiles/seccomp/default.json

Then configure the daemon:

json
{
  "seccomp-profile": "/etc/docker/default-seccomp.json"
}
4Run container without seccomp (testing only)

To bypass seccomp temporarily for debugging:

bash
docker run --rm -it --security-opt seccomp=unconfined ubuntu:latest

Warning: Running without seccomp removes an important security layer. Only use this for testing, never in production.

In Docker Compose:

yaml
services:
  myapp:
    image: myimage
    security_opt:
      - seccomp:unconfined
5Fix clone3 syscall errors

A common error on older kernels involves the clone3 syscall:

bash
error adding seccomp filter rule for syscall clone3: permission denied

This happens with Docker 20.10+ on older kernels. To fix:

Option 1: Update your kernel (recommended)

bash
# Ubuntu/Debian
sudo apt update && sudo apt upgrade

# After kernel upgrade, reboot
sudo reboot

Option 2: Use a modified profile without clone3
Download and modify the default profile to remove clone3 references, or use an older compatible profile.

6Verify seccomp is working correctly

After fixing the issue, verify seccomp is properly applied:

bash
# Check Docker's security options
docker info --format '{{ .SecurityOptions }}'

You should see seccomp in the output.

Check seccomp status inside a container:

bash
docker run --rm alpine grep Seccomp /proc/1/status

- Seccomp: 2 means seccomp filter is active (secure)
- Seccomp: 0 means no seccomp profile applied (unconfined)

7Restart Docker after configuration changes

If you modified daemon.json or updated kernel, restart Docker:

bash
# Restart Docker daemon
sudo systemctl restart docker

# Verify it started correctly
sudo systemctl status docker

# Check for seccomp-related errors in logs
sudo journalctl -u docker -n 50 | grep -i seccomp

If the daemon fails to start, check the seccomp profile path in your daemon.json is correct.

Advanced notes

### Understanding Seccomp Profiles

Docker's default seccomp profile blocks approximately 44 out of 300+ Linux syscalls. The profile uses an allowlist approach with a default action of SCMP_ACT_ERRNO (deny with error).

Key profile structure:

json
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86"],
  "syscalls": [
    {
      "names": ["read", "write", "open"],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

### Kernel Upgrade Considerations

After upgrading your kernel, always reboot before running Docker. A common error scenario:

1. Upgrade from kernel 4.x to 5.x
2. Don't reboot
3. Docker tries to use new syscalls available in kernel 5.x
4. Running kernel (4.x) doesn't support them
5. Seccomp filter fails to load

### Debian/Ubuntu Post-Upgrade Error

A well-known issue occurs after upgrading from Debian 8 (Jessie) to Debian 9 (Stretch):

bash
OCI runtime create failed: error loading seccomp filter into kernel: invalid argument

Solution: Reboot the server after the upgrade.

### Docker Swarm and Seccomp

In Docker Swarm mode, the security_opt directive is not supported for services:

bash
Ignoring unsupported options: security_opt

For Swarm services requiring custom seccomp profiles, you need to configure the profile at the daemon level on all swarm nodes.

### Debugging with strace

For deep troubleshooting, use strace to identify which syscall is failing:

bash
docker run --rm -it --cap-add=SYS_PTRACE --security-opt seccomp=unconfined \
  ubuntu strace -f your-command 2>&1 | grep -i denied

### Profile Locations

- Default profile source: https://github.com/moby/profiles/blob/main/seccomp/default.json
- Daemon configuration: /etc/docker/daemon.json
- Custom profiles: Commonly stored in /etc/docker/seccomp/

Frequently asked questions

What does "Error response from daemon: error loading seccomp profile" mean?
Seccomp (Secure Computing Mode) is a Linux kernel feature that restricts system calls available to containers, providing an additional layer of security. Docker uses seccomp profiles to define which syscalls are allowed or denied inside containers. When you see "error loading seccomp profile," the Docker daemon is unable to parse or apply the seccomp profile specified either in the daemon configuration or via the --security-opt flag.
How do I fix "Error response from daemon: error loading seccomp profile"?
This error occurs when Docker cannot load or parse a seccomp security profile. The issue is typically caused by an invalid JSON profile file, incorrect file path, or kernel incompatibility. Fixes include verifying the profile syntax, using the default profile, or temporarily disabling seccomp.
What causes "Error response from daemon: error loading seccomp profile"?
The seccomp profile JSON file has syntax errors or is malformed The profile file path specified doesn't exist or is inaccessible The profile references syscalls not supported by the kernel version
Is the "Error response from daemon: error loading seccomp profile" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading