Unable to exec a new process inside of an existing container

I am unable to exec a new process inside of an existing container. I have seen similar issues reported, but none of the solutions seems to have made a difference in my case. This last worked for me on Docker 1.10.3, prior to the introduction of runc. Since then, it has consistently failed.

[x] This is a bug report
[ ] This is a feature request
[X] I searched existing issues before opening this one

Note that the OS was recently upgraded from Ubuntu Trusty to Xenial. The behavior is the same under both. I have tried removing and reinstalling Docker but that has not helped.

Expected behavior

docker exec -it <container> bash should allow me to run bash from within the specified container.

Actual behavior

Fails with: rpc error: code = 2 desc = oci runtime error: exec failed: container_linux.go:262: starting container process caused "process_linux.go:81: executing setns process caused \"exit status 16\""

I tried using docker-runc directly:

sudo docker-runc --debug exec 31c58169d1b77f618d7a03243377105677c387ee341e2c62ef5d946e94d09a7b ps

nsenter: failed to setns to /proc/9274/ns/ipc: Invalid argument
exec failed: container_linux.go:262: starting container process caused "process_linux.go:81: executing setns process caused \"exit status 16\""

Steps to reproduce the behavior

Try to run a command in any existing container. It fails with the error above. Note that I am able to use docker run -it --rm alpine sh to get a shell in a newly created container.

Output of docker version:

Client:
 Version:      17.06.0-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:23:31 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.06.0-ce
 API version:  1.30 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:19:04 2017
 OS/Arch:      linux/amd64
 Experimental: false

Output of docker info:

Containers: 4
 Running: 2
 Paused: 0
 Stopped: 2
Images: 319
Server Version: 17.06.0-ce
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 581
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins: 
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: cfb82a876ecc11b5ca0977d1733adbe58599088a
runc version: 2d41c047c83e09a6d61d464906feb2a2f3c52aa4
init version: 949e6fa
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-28-generic
Operating System: Ubuntu 16.04.2 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 31.05GiB
Name: mkeefe
ID: F553:2LHJ:OYT5:OVBH:N6IG:IX5V:DXR3:OHWQ:2WGJ:FD5M:XN2L:KLH5
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.)

This is running on physical hardware (Lenovo ThinkPad W541).

docker / for-linux