OCI runtime create failed: namespace {"time" ""} does not exist

[cvmvxunm]

After a Linux kernel and docker CE update, container creation fails with error message:

$ docker run --rm --runtime=sysbox-runc hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
4f55086f7dd0: Pull complete
d5e71e642bf5: Download complete
Digest: sha256:0e760fdfbc48ba8041e7c6db999bb40bfca508b4be580ac75d32c4e29d202ce1
Status: Downloaded newer image for hello-world:latest
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: namespace {"time" ""} does not exist

Run 'docker run --help' for more information

Versions:

$ sysbox-runc --version
sysbox-runc
        edition:        Community Edition (CE)
        version:        0.7.0
        commit:         a4dd414f7b9b7455c0fbf0d5e5db7bcfe30645bc
        built at:       Tue Mar  3 21:51:47 UTC 2026
        built by:       Cesar Talledo
        oci-specs:      1.1.0+dev

$ docker --version
Docker version 29.5.0, build 98f1464

$ uname -a
Linux aco-tsstage-p 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.4 LTS"

Regressing to sysbox-runc 0.6.7 did not change the situation.

[st0rmi]

I have the exact same issue in my setup. I have a temporary workaround that wraps the sysbox-runc and strips the time namespace. Note that this is AI-generated and I have not yet tested this in-depth. Use with caution!

#!/bin/bash
# AI-generated, use with caution!

# Strip "time" namespace from config.json before invoking sysbox-runc

for arg in "$@"; do
  if [ -d "$arg" ] && [ -f "$arg/config.json" ]; then
    # Found bundle dir
    jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
      "$arg/config.json" > "$arg/config.json.tmp" && \
      mv "$arg/config.json.tmp" "$arg/config.json"
  fi
done

# Also handle --bundle flag
prev=""
for arg in "$@"; do
  if [ "$prev" = "--bundle" ] || [ "$prev" = "-b" ]; then
    if [ -f "$arg/config.json" ]; then
      jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
        "$arg/config.json" > "$arg/config.json.tmp" && \
        mv "$arg/config.json.tmp" "$arg/config.json"
    fi
  fi
  prev="$arg"
done

exec /usr/bin/sysbox-runc "$@"

[deadlyhawk]

I have the same issue with sysbox-runc 0.6.4 and 0.6.7 on Debian 13 (trixie).

With docker-ce 5:29.4.3-1debian.13trixie, this command works without issues:

docker run --runtime=sysbox-runc --rm -it debian:bookworm-slim

After upgrading to docker-ce 5:29.5.0-1debian.13trixie, the same command fails with:

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: namespace {"time" ""} does not exist

This looks related to the Docker 29.5.0 change:

"Enable private time namespace for containers by default on supported kernels"
moby/moby#52326

Release notes:
https://docs.docker.com/engine/release-notes/29/

[cvmvxunm]

I have the exact same issue in my setup. I have a temporary workaround that wraps the sysbox-runc and strips the time namespace. Note that this is AI-generated and I have not yet tested this in-depth. Use with caution!

#!/bin/bash
# AI-generated, use with caution!

# Strip "time" namespace from config.json before invoking sysbox-runc

for arg in "$@"; do
  if [ -d "$arg" ] && [ -f "$arg/config.json" ]; then
    # Found bundle dir
    jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
      "$arg/config.json" > "$arg/config.json.tmp" && \
      mv "$arg/config.json.tmp" "$arg/config.json"
  fi
done

# Also handle --bundle flag
prev=""
for arg in "$@"; do
  if [ "$prev" = "--bundle" ] || [ "$prev" = "-b" ]; then
    if [ -f "$arg/config.json" ]; then
      jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
        "$arg/config.json" > "$arg/config.json.tmp" && \
        mv "$arg/config.json.tmp" "$arg/config.json"
    fi
  fi
  prev="$arg"
done

exec /usr/bin/sysbox-runc "$@"

Thank you. How would you implement this in practice? How is docker run --rm --runtime=sysbox-runc hello-world changed to now work? I tried creating a wrapper script but it appears it has to be registered with containerd somehow for it to be found?

[ARVEDz]

I temporarily edited the new time flag to false:

In /etc/docker/daemon.json:

"features": {
"time-namespaces": false

[cvmvxunm]

I temporarily edited the new time flag to false:

In /etc/docker/daemon.json:

"features": { "time-namespaces": false

This works for me. Thank you.

[st0rmi]

I have the exact same issue in my setup. I have a temporary workaround that wraps the sysbox-runc and strips the time namespace. Note that this is AI-generated and I have not yet tested this in-depth. Use with caution!

#!/bin/bash
# AI-generated, use with caution!

# Strip "time" namespace from config.json before invoking sysbox-runc

for arg in "$@"; do
  if [ -d "$arg" ] && [ -f "$arg/config.json" ]; then
    # Found bundle dir
    jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
      "$arg/config.json" > "$arg/config.json.tmp" && \
      mv "$arg/config.json.tmp" "$arg/config.json"
  fi
done

# Also handle --bundle flag
prev=""
for arg in "$@"; do
  if [ "$prev" = "--bundle" ] || [ "$prev" = "-b" ]; then
    if [ -f "$arg/config.json" ]; then
      jq 'if .linux.namespaces then .linux.namespaces |= map(select(.type != "time")) else . end' \
        "$arg/config.json" > "$arg/config.json.tmp" && \
        mv "$arg/config.json.tmp" "$arg/config.json"
    fi
  fi
  prev="$arg"
done

exec /usr/bin/sysbox-runc "$@"

Thank you. How would you implement this in practice? How is docker run --rm --runtime=sysbox-runc hello-world changed to now work? I tried creating a wrapper script but it appears it has to be registered with containerd somehow for it to be found?

You save it somewhere on disk (e.g. in /usr/local/bin/) and configure it as the runtime for docker either in daemon.json or use it via the --runtime in the docker run command. But the solution of disabling time namespaces altogether via daemon.json seems like a better one to me. Didn't know this was an option.

[rfay]

Adding this to /etc/docker/daemon.json also fixed for me:

    "features": {
	    "time-namespaces": false
    },