The problem:
Therefore, the following platforms are not suitable as Docker hosts for 32-bit Alpine Linux 3.13.0, due to containing out-of-date libseccomp: Amazon Linux 1 or 2, CentOS 7 or 8, Debian stable without debian-backports, Raspbian stable, Ubuntu 14.04 or earlier, and Windows. This applies regardless of whether the Linux distribution Docker packages or separate Docker package repositories are used.
Perhaps a solution:
In order to run under old Docker or libseccomp versions, the moby default seccomp profile should be downloaded and on line 2, defaultAction
changed to SCMP_ACT_TRACE
, then --seccomp-profile=default.json
can be passed to dockerd, or --security-opt=seccomp=default.json
passed to docker create
or docker run
. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to 32-bit time system calls. In this case, the container will not be compatible with dates past 2038.
Alternatively, --security-opt=seccomp=unconfined
can be passed with no default.json
required, but note that this will reduce the security of the host against malicious code in the container.