{"record":{"id":"2029b61586219701","repo":"juicedata/juicefs","slug":"invalid-cgroup-entry-q","errorCode":null,"errorMessage":"invalid cgroup entry: %q","messagePattern":"invalid cgroup entry: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/fuse/device_linux.go","lineNumber":61,"sourceCode":"\tcgroupPath := fmt.Sprintf(\"/proc/%d/cgroup\", pid)\n\tcgroupFile, err := os.Open(cgroupPath)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"open %s\", cgroupPath)\n\t}\n\tdefer cgroupFile.Close()\n\n\tcgroupScanner := bufio.NewScanner(cgroupFile)\n\tvar deviceCgroup string\n\tfor cgroupScanner.Scan() {\n\t\tif err := cgroupScanner.Err(); err != nil {\n\t\t\treturn errors.Wrap(err, \"read cgroup file\")\n\t\t}\n\t\tvar (\n\t\t\ttext  = cgroupScanner.Text()\n\t\t\tparts = strings.SplitN(text, \":\", 3)\n\t\t)\n\t\tif len(parts) < 3 {\n\t\t\treturn errors.Errorf(\"invalid cgroup entry: %q\", text)\n\t\t}\n\n\t\tif parts[1] == \"devices\" {\n\t\t\tdeviceCgroup = parts[2]\n\t\t}\n\t}\n\n\tif len(deviceCgroup) == 0 {\n\t\treturn errors.Errorf(\"fail to find device cgroup\")\n\t}\n\n\tdeviceListPath := path.Join(\"/sys/fs/cgroup/devices\" + deviceCgroup, \"/devices.list\")\n\tdeviceAllowPath := path.Join(\"/sys/fs/cgroup/devices\" + deviceCgroup, \"/devices.allow\")\n\n\t// check if fuse is already allowed\n\tdeviceListFile, err := os.OpenFile(deviceListPath, os.O_RDONLY, 0)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"open %s\", deviceListPath)","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/fuse/device_linux.go#L43-L79","documentation":"grantAccess scans /proc/self/cgroup to locate the device cgroup controller so it can grant access to /dev/fuse. Each line must have the form hierarchy-id:controller-list:cgroup-path (at least 3 colon-separated fields). If a line splits into fewer than 3 parts, the entry is malformed and the scan aborts with this error.","triggerScenarios":"Running a JuiceFS mount inside a container or host where /proc/self/cgroup contains a line without two ':' separators — e.g. non-standard formats emitted by custom container runtimes or unusual cgroup configurations.","commonSituations":"Mounting JuiceFS inside Docker/Kubernetes pods; minimal containers with abbreviated cgroup files; custom runtimes (gVisor, Kata) that fake /proc/self/cgroup with unexpected formats.","solutions":["Check 'cat /proc/self/cgroup' on the host where the mount runs and confirm every line has the standard 3-field colon-separated format","Run the mount on a host where /proc/self/cgroup is standard (cgroup v1 with controllers, or standard cgroup v2 '0::/path' lines)","Grant the FUSE device manually (write 'c 10:229 rwm' to the container's devices.allow, or use --device=/dev/fuse --cap-add SYS_ADMIN in Docker) so grantAccess is not required","Upgrade to a JuiceFS version handling the environment's cgroup layout"],"exampleFix":"// before (custom runtime faking cgroup file)\n./juicefs mount redis://host/1 /mnt/jfs\n// error: invalid cgroup entry: \"bogusline\"\n// after (docker with explicit device access)\ndocker run --device /dev/fuse --cap-add SYS_ADMIN juicefs mount ...","handlingStrategy":"validation","validationCode":"if data, err := os.ReadFile(\"/proc/self/cgroup\"); err == nil {\n  for _, line := range strings.Split(string(data), \"\\n\") {\n    if line != \"\" && strings.Count(line, \":\") < 2 {\n      // malformed cgroup entry; grantAccess will fail — grant device manually\n    }\n  }\n}","typeGuard":"func cgroupEntriesWellFormed(cgroupFile string) bool {\n  data, err := os.ReadFile(cgroupFile)\n  if err != nil { return false }\n  for _, line := range strings.Split(string(data), \"\\n\") {\n    if line == \"\" { continue }\n    if len(strings.SplitN(line, \":\", 3)) < 3 { return false }\n  }\n  return true\n}","tryCatchPattern":"if err := grantAccess(); err != nil && strings.Contains(err.Error(), \"invalid cgroup entry\") {\n  // fall back to manual device grant or warn and continue\n  logger.Warnf(\"cgroup device grant skipped: %v\", err)\n}","preventionTips":["Inspect /proc/self/cgroup before mounting in exotic container runtimes","Pre-grant /dev/fuse in container images instead of relying on runtime cgroup writes","Run mounts as root with SYS_ADMIN when devices cgroup access is needed"],"tags":["linux","cgroups","fuse","mount"],"backgroundTag":"invalid-argument-format","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}