Docker PHP builds failing on servers? A seccomp and xz sandbox conflict explained

Developers running Docker-based PHP builds on certain Linux servers may encounter a reproducible failure caused by a conflict between recent versions of xz, older distribution kernels, and Docker's default seccomp profile. Modern xz attempts to activate a Landlock sandbox before processing data, but when the server kernel lacks support, Docker's seccomp filter returns EACCES instead of ENOSYS, causing xz to abort rather than proceed. The fix involves creating a custom seccomp profile that explicitly blocks Landlock-related syscalls and restarting the Docker daemon with that profile applied. Additionally, Docker BuildKit must be disabled using DOCKER_BUILDKIT=0, since the modern build engine bypasses the custom seccomp profile entirely. The author notes this is a temporary workaround rather than a true fix, and the custom profile should be removed once the server kernel is upgraded to one that supports Landlock natively.