Failed to close file descriptor when running in a container

[avylove]

I've noticed in my CI workflows, I get the following error:

Warning: Cannot remove repo/repodata.old.119.20250129193340.189567: Failed to close file descriptor for child process (Operation not permitted)

As a result, the old metadata doesn't get removed. I haven't seen this outside of CI, which runs in a Rocky 9 docker container on a Ubuntu 20.04 host. I found some references for similar issues that suggest using the docker option --security-opt seccomp=unconfined as a workaround. This does work, but, instead, I'm just running rm -rf repo/repodata.old.* after createrepo finishes.

I'm hoping to get the host machine replaced soon and I suspect that will resolve the issue, but I wanted to report it in case someone else encounters it.