@@ -10,7 +10,11 @@ import (

 func (daemon *Daemon) saveAppArmorConfig(container *container.Container) error {

 	container.AppArmorProfile = "" // reset; parseSecurityOpt re-derives it from HostConfig.SecurityOpt.

-	if !daemon.RawSysInfo().AppArmor {

+	sysInfo, err := daemon.RawSysInfo()

+	if err != nil {

+		return errdefs.System(err)

+	}

+	if !sysInfo.AppArmor {

 		return nil // if apparmor is disabled there is nothing to do here.

 	}

@@ -1872,7 +1872,7 @@ func (daemon *Daemon) BuilderBackend() builder.Backend {

 }

 // RawSysInfo returns *sysinfo.SysInfo .

-func (daemon *Daemon) RawSysInfo() *sysinfo.SysInfo {

+func (daemon *Daemon) RawSysInfo() (*sysinfo.SysInfo, error) {

 	daemon.sysInfoOnce.Do(func() {

 		// We check if sysInfo is not set here, to allow some test to

 		// override the actual sysInfo.

@@ -1881,7 +1881,7 @@ func (daemon *Daemon) RawSysInfo() *sysinfo.SysInfo {

 		}

 	})

-	return daemon.sysInfo

+	return daemon.sysInfo, nil

 }

 // imageBackend is used to satisfy the [executorpkg.ImageBackend] and

@@ -631,7 +631,10 @@ func verifyPlatformContainerSettings(daemon *Daemon, daemonCfg *configStore, hos

 	if hostConfig == nil {

 		return nil, nil

 	}

-	sysInfo := daemon.RawSysInfo()

+	sysInfo, err := daemon.RawSysInfo()

+	if err != nil {

+		return nil, err

+	}

 	w, err := verifyPlatformContainerResources(&hostConfig.Resources, sysInfo, update)

@@ -44,7 +44,10 @@ func doWithTrace[T any](ctx context.Context, name string, f func() T) T {

 func (daemon *Daemon) SystemInfo(ctx context.Context) (*system.Info, error) {

 	defer metrics.StartTimer(metrics.HostInfoFunctions.WithValues("system_info"))()

-	sysInfo := daemon.RawSysInfo()

+	sysInfo, err := daemon.RawSysInfo()

+	if err != nil {

+		return nil, err

+	}

 	cfg := daemon.config()

 	v := &system.Info{

@@ -272,7 +272,11 @@ func WithNamespaces(daemon *Daemon, c *container.Container) coci.SpecOpts {

 		// Remove time-namespace if not supported. We can remove this once we

 		// drop support for kernel < 5.6.

-		if !daemon.RawSysInfo().TimeNamespaces {

+		sysInfo, err := daemon.RawSysInfo()

+		if err != nil {

+			return errdefs.System(err)

+		}

+		if !sysInfo.TimeNamespaces {

 			oci.RemoveNamespace(s, specs.TimeNamespace)

 		}

@@ -28,7 +28,11 @@ func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

 			}

 			return err

 		}

-		if !daemon.RawSysInfo().Seccomp {

+		sysInfo, err := daemon.RawSysInfo()

+		if err != nil {

+			return err

+		}

+		if !sysInfo.Seccomp {

 			if c.SeccompProfile != "" && c.SeccompProfile != dconfig.SeccompProfileDefault {

 				return errors.New("seccomp is not enabled in your kernel, cannot run a custom seccomp profile")

 			}

@@ -39,7 +43,6 @@ func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

 		if s.Linux == nil {

 			s.Linux = &specs.Linux{}

 		}

-		var err error

 		switch {

 		case c.SeccompProfile == dconfig.SeccompProfileDefault:

 			s.Linux.Seccomp, err = seccomp.GetDefaultProfile(s)

@@ -71,7 +71,7 @@ type commitBackend interface {

 }

 type sysInfoProvider interface {

-	RawSysInfo() *sysinfo.SysInfo

+	RawSysInfo() (*sysinfo.SysInfo, error)

 }

 // Backend is all the methods that need to be implemented to provide container specific functionality.

@@ -557,7 +557,11 @@ func (c *containerRouter) postContainersCreate(ctx context.Context, w http.Respo

 	rdr := io.TeeReader(r.Body, &requestBody)

 	// TODO(thaJeztah): do we prefer [backend.ContainerCreateConfig] here?

-	req, err := runconfig.DecodeCreateRequest(rdr, c.backend.RawSysInfo())

+	sysInfo, err := c.backend.RawSysInfo()

+	if err != nil {

+		return err

+	}

+	req, err := runconfig.DecodeCreateRequest(rdr, sysInfo)

 	if err != nil {

 		return err

 	}

@@ -598,7 +602,7 @@ func (c *containerRouter) postContainersCreate(ctx context.Context, w http.Respo

 	if versions.LessThan(version, "1.41") {

 		// Older clients expect the default to be "host" on cgroup v1 hosts

-		if hostConfig.CgroupnsMode.IsEmpty() && !c.backend.RawSysInfo().CgroupUnified {

+		if hostConfig.CgroupnsMode.IsEmpty() && !sysInfo.CgroupUnified {

 			hostConfig.CgroupnsMode = container.CgroupnsModeHost

 		}

 	}