{"record":{"id":"0a7fa0645ea8287e","repo":"juicedata/juicefs","slug":"open-s","errorCode":null,"errorMessage":"open %s","messagePattern":"open %s","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/fuse/device_linux.go","lineNumber":46,"sourceCode":"\n// ensureFuseDev ensures /dev/fuse exists. If not, it will create one\nfunc ensureFuseDev() {\n\tif _, err := os.Stat(\"/dev/fuse\"); os.IsNotExist(err) {\n\t\t// 10, 229 according to https://www.kernel.org/doc/Documentation/admin-guide/devices.txt\n\t\tfuse := unix.Mkdev(10, 229)\n\t\tif err := syscall.Mknod(\"/dev/fuse\", 0o666|syscall.S_IFCHR, int(fuse)); err != nil {\n\t\t\tlogger.Errorf(\"mknod /dev/fuse: %v\", err)\n\t\t}\n\t}\n}\n\n// grantAccess appends 'c 10:229 rwm' to devices.allow\nfunc grantAccess() error {\n\tpid := os.Getpid()\n\tcgroupPath := fmt.Sprintf(\"/proc/%d/cgroup\", pid)\n\tcgroupFile, err := os.Open(cgroupPath)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"open %s\", cgroupPath)\n\t}\n\tdefer cgroupFile.Close()\n\n\tcgroupScanner := bufio.NewScanner(cgroupFile)\n\tvar deviceCgroup string\n\tfor cgroupScanner.Scan() {\n\t\tif err := cgroupScanner.Err(); err != nil {\n\t\t\treturn errors.Wrap(err, \"read cgroup file\")\n\t\t}\n\t\tvar (\n\t\t\ttext  = cgroupScanner.Text()\n\t\t\tparts = strings.SplitN(text, \":\", 3)\n\t\t)\n\t\tif len(parts) < 3 {\n\t\t\treturn errors.Errorf(\"invalid cgroup entry: %q\", text)\n\t\t}\n\n\t\tif parts[1] == \"devices\" {","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/fuse/device_linux.go#L28-L64","documentation":"grantAccess (called when setting up the FUSE device inside containers) wraps os.Open of /proc/<pid>/cgroup. It reads this file to find the devices cgroup so it can append 'c 10:229 rwm' to devices.allow and grant access to /dev/fuse. Failure to open the procfs cgroup file is wrapped with the path in this message.","triggerScenarios":"Mounting JuiceFS via FUSE inside a container/namespace where /proc/<pid>/cgroup cannot be opened: /proc not mounted in the container, procfs hidden, the process exited so the path is gone, or seccomp/AppArmor blocking procfs access.","commonSituations":"Docker/Kubernetes containers without /proc mounted; running under restricted security profiles (seccomp filters, gVisor) that deny procfs reads; PID-namespace edge cases where the pid lookup fails.","solutions":["Ensure /proc is mounted in the container (docker run defaults do this; check `cat /proc/self/cgroup` works)","Run the mount with sufficient privileges (privileged container or --device /dev/fuse --cap-add SYS_ADMIN)","Pre-grant /dev/fuse so grantAccess is unnecessary (e.g. docker run --device /dev/fuse)","Check security modules (seccomp/AppArmor/SELinux) logs and relax the profile for procfs reads"],"exampleFix":"// before\ndocker run juicefs/juicefs mount redis://... /mnt/jfs        # no /proc/fuse access\n// after\ndocker run --privileged --device /dev/fuse juicefs/juicefs mount redis://... /mnt/jfs","handlingStrategy":"fallback","validationCode":"if _, err := os.ReadFile(\"/proc/self/cgroup\"); err != nil { return fmt.Errorf(\"procfs unavailable in this environment: %w\", err) }\nif _, err := os.Stat(\"/dev/fuse\"); err != nil { return fmt.Errorf(\"/dev/fuse not present: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := mount(...); err != nil {\n\tif strings.Contains(err.Error(), \"open /proc/\") {\n\t\tlog.Printf(\"cannot access cgroup procfs; run privileged or pre-grant /dev/fuse\")\n\t}\n}","preventionTips":["Run FUSE mounts in privileged containers or with --device /dev/fuse","Verify /proc is mounted and readable before mounting in containers","Check seccomp/AppArmor profiles allow procfs reads"],"tags":["fuse","cgroup","container","linux","procfs"],"backgroundTag":"file-open-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}