#1121245 runc: Starting docker container fails with "runc create failed"

Package:
runc
Source:
runc
Description:
Open Container Project - runtime
Submitter:
Detlef Vollmann
Date:
2026-04-07 17:43:02 UTC
Severity:
normal
#1121245#5
Date:
2025-11-23 18:16:47 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?
Starting a docker container with this command:
docker run \
  -d --rm --user $UID:$UID -w $HOME \
  --security-opt "seccomp=$HOME/cfg/docker-cfg.json" \
  --network special --dns=8.8.8.8 \
  -v /run/user/$UID/pulse:$HOME/.pulseHost \
  -v /tmp/.X11-unix:/tmp/.X11-unix \
  $IMAGE $CMD

   * What was the outcome of this action?

Following error message:
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error closing exec fds: get handle to /proc/thread-self/fd: unsafe procfs detected: openat2 fsmount:fscontext:proc/thread-self/fd/: function not implemented: unknown.

The container was not started.

   * What outcome did you expect instead?
That the container would be started.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

Downgrading to 1.3.2+ds1-1 solved the problem.


I found <https://forums.docker.com/t/unable-to-start-container-process/150457>
That proposed to downgrade containerd, which didn't help for me.
But it also mentioned runc, and downgrading that helped.
#1121245#10
Date:
2026-04-07 01:17:00 UTC
From:
To:
Hi, Detlef,

runc 1.3.3 introduced openat2 usage (via an updated securejoin library)
for security hardening. Since openat2 has been available since Linux 5.6
(2020), your kernel (6.17.8) almost certainly supports it.

The likely culprit is your custom seccomp profile. You're passing
--security-opt "seccomp=$HOME/cfg/docker-cfg.json". If that profile was
created for an older runc, it probably doesn't include openat2 in the
allowed syscall list -- seccomp would then block it and return "function
not implemented".

Quick test: Remove the --security-opt seccomp=... line from your docker
run command. If the container starts, the seccomp profile is the
problem.

Fix: Add openat2 to the allowed syscalls in your docker-cfg.json:

{"names": ["openat2"], "action": "SCMP_ACT_ALLOW"}

Downgrading to runc 1.3.2 works around the issue because that version didn't use openat2.

Let me know if that is indeed the case.

Best,
-rt
#1121245#15
Date:
2026-04-07 17:26:18 UTC
From:
To:
Hi Reinhart,

thanks for looking into this.

Will do.  However I just started a trip and will only be back
in my office end of next week.  I will report then.

Thanks again,
  Detlef