Docker "oci runtime error: container_linux mkdir /proc" in CI

By Daniel Zoghalchali·Latchkey

During container setup runc creates and mounts pseudo-filesystems like /proc. When it cannot - because the container lacks the privilege to mount procfs, or it is running nested without the needed capabilities - startup fails with an OCI runtime mkdir/mount error on /proc.

What this error means

A container fails to start with oci runtime error: container_linux.go: ...: mkdir /proc: operation not permitted or a related procfs mount failure.

docker

Error response from daemon: oci runtime error: container_linux.go:235: starting container process caused "process_linux.go:258: applying cgroup configuration for process caused \"mkdir /proc/sys/...: operation not permitted\""

Diagnose it: read the container, not the compose file

A container that exits immediately in CI has almost always logged the reason and then been cleaned up. Capture the logs and the exit code before changing configuration.

Terminal

# why did it stop?
docker ps -a --format '{{.Names}}\t{{.Status}}\t{{.Image}}'
docker logs <container> 2>&1 | tail -50
docker inspect <container> --format '{{.State.ExitCode}} {{.State.OOMKilled}} {{.State.Error}}'

Common causes

Insufficient privileges to mount procfs

A heavily restricted runtime or dropped capabilities prevent runc from mounting /proc.

Nested containers without required capabilities

Running Docker-in-Docker or under a restricted sandbox can deny the procfs mount.

An incompatible or restricted seccomp/AppArmor profile

A profile that blocks the mount syscall trips this during setup.

How to fix it

Grant the privileges the runtime needs

For dind-style workloads, run the daemon container privileged so it can mount procfs.

service config

services:
  docker:
    image: docker:27-dind
    privileged: true

Relax the restricting security profile

If a custom seccomp/AppArmor profile blocks the mount, use the default profile for the affected container.

Terminal

docker run --security-opt seccomp=unconfined myorg/app:ci

How to prevent it

Run dind daemons with the privileges they require to mount procfs.
Avoid over-restrictive seccomp/AppArmor profiles that block container setup.

Frequently asked questions

What causes Docker "oci runtime error: container_linux mkdir /proc" in CI?

There are 3 common causes: insufficient privileges to mount procfs, nested containers without required capabilities, and an incompatible or restricted seccomp/apparmor profile. A heavily restricted runtime or dropped capabilities prevent runc from mounting /proc.

How do I fix Docker "oci runtime error: container_linux mkdir /proc" in CI?

There are 2 fixes depending on which cause you have: grant the privileges the runtime needs and relax the restricting security profile. Work through them in order, since the first is the most common.

What does Docker "oci runtime error: container_linux mkdir /proc" in CI actually mean?

A container fails to start with oci runtime error: container_linux.go: ...: mkdir /proc: operation not permitted or a related procfs mount failure.

How do I stop Docker "oci runtime error: container_linux mkdir /proc" in CI happening again?

Run dind daemons with the privileges they require to mount procfs. The prevention section lists 2 changes that keep it from recurring.