Adding custom seccomp profile in docker

user_3862410 0
Viewed 2513

I am trying to use a custom seccomp profile with docker run command; however, I invoked with the following error-

$ sudo docker run --rm -it --security-opt seccomp=/home/temp/default.json ubuntu
docker: Error response from daemon: OCI runtime create failed: container_linux.go:380: starting container process caused: error adding seccomp filter rule for syscall clone3: permission denied: unknown.
$ docker -v
Docker version 20.10.8, build 3967b7d

What would be the possible cause for this issue?

Note that, I have modified the default seccomp profile file to enable the Linux perf tool (I have followed this post).

seccomp docker-run docker system-calls
3 Answers

install or update runc

sudo apt-get install runc
user_53418720

Secure computing mode （secure computing mode,seccomp） yes Linux Kernel functions . You can use it to limit the operations available in the container .seccomp() The system call is at the end of the calling process seccomp Running in state . You can use this feature to limit the of your application Access right .

docker After abnormal exit , I can't seem to find it secomp This configuration file , So can't start .

solve Start up docker Add

--security-opt seccomp=unconfined

user_17121500

You can use it to limit the operations available in the container. seccomp() is a system call is at the end of the calling process seccomp Running in state. I solve the issue using this feature to limit the application Access right.

solve Start up docker Add

docker run --security-opt=seccomp:unconfined <id>

of in my docker-compose.yml

version: '3'
services:


  my_app:
    build:
      args: 
        APP_ENVIRONMENT: ${APP_ENVIRONMENT} 
        USERNAME: ${USERNAME}
        GID: ${GID}
        UID: ${UID}
        APP_MSSQL: ${APP_MSSQL}
        APP_PHP_VERSION_DEV: ${APP_PHP_VERSION_DEV}
        APP_AUTH_MS_PROFILE: ${APP_AUTH_MS_PROFILE}
        APP_NODE_URL: ${APP_NODE_URL}
      context: .
      dockerfile: Dockerfile.app
    image: "php:${APP_VERSION}"
    container_name: hero_app
    restart: unless-stopped
    tty: true
    security_opt:
      - seccomp:unconfined
    environment:
      SERVICE_NAME: my_app
      SERVICE_TAGS: dev
    working_dir: /var/www
    volumes:
      - ./src/app/:/var/www:Z
user_17121500
Related