{"record":{"id":"5d8f714c3d3e3b8b","repo":"hashicorp/nomad","slug":"unable-to-configure-cgroups-w","errorCode":null,"errorMessage":"unable to configure cgroups: %w","messagePattern":"unable to configure cgroups: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/shared/executor/executor.go","lineNumber":390,"sourceCode":"\n\t// set the task dir as the working directory for the command\n\tif e.command.WorkDir != \"\" {\n\t\te.childCmd.Dir = e.command.WorkDir\n\t} else {\n\t\te.childCmd.Dir = e.command.TaskDir\n\t}\n\n\t// start command in separate process group\n\tif err := e.setNewProcessGroup(); err != nil {\n\t\treturn nil, err\n\t}\n\n\t// setup containment (i.e. cgroups on linux)\n\trunning, cleanup, err := e.configureResourceContainer(command, os.Getpid())\n\tif err != nil {\n\t\te.logger.Error(\"failed to configure container, process isolation will not work\", \"error\", err)\n\t\tif os.Geteuid() == 0 || e.usesCustomCgroup() {\n\t\t\treturn nil, fmt.Errorf(\"unable to configure cgroups: %w\", err)\n\t\t}\n\t\t// keep going if we are not root; some folks run nomad as non-root and\n\t\t// expect this driver to still work\n\t} else {\n\t\tdefer cleanup()\n\t}\n\n\tstdout, err := e.command.Stdout()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tstderr, err := e.command.Stderr()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\te.childCmd.Stdout = stdout\n\te.childCmd.Stderr = stderr","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/shared/executor/executor.go#L372-L408","documentation":"Launch calls configureResourceContainer to place the task under a cgroup for isolation. If that fails AND the executor runs as root or uses a custom cgroup parent, the failure is fatal and wrapped with this message. Non-root executors log a warning and continue, since cgroups are expected to be unavailable there.","triggerScenarios":"configureResourceContainer returns an error — e.g. cgroup v2 hierarchy unexpected, /sys/fs/cgroup not writable, cgroup subsystem unavailable, systemd cgroup driver mismatch, or existing cgroup path conflicts.","commonSituations":"Nomad client running as root on a host with cgroup v2 and an older Nomad, cgroup controllers disabled via kernel cmdline (cgroup_disable=memory), containers-in-containers (nested cgroup limits), read-only /sys/fs/cgroup mount, invalid client cgroup config.","solutions":["Check the wrapped %w cause to identify the cgroup subsystem failure","Ensure /sys/fs/cgroup is mounted and writable by the nomad client (not read-only)","Verify kernel cmdline hasn't disabled required controllers (cgroup_disable=...)","Upgrade Nomad for cgroup v2 support or boot with systemd.unified_cgroup_hierarchy=0 as a workaround","If running nomad as non-root intentionally, confirm Geteuid()!=0 so execution continues with a warning"],"exampleFix":"// before\n// mount: ro /sys/fs/cgroup in container running nomad\n// after (docker run)\n// docker run --cgroupns=host -v /sys/fs/cgroup:/sys/fs/cgroup:rw ...","handlingStrategy":"fallback","validationCode":"func cgroupsUsable() error {\n  st, err := os.Stat(\"/sys/fs/cgroup\")\n  if err != nil { return err }\n  if !st.IsDir() { return errors.New(\"/sys/fs/cgroup not a dir\") }\n  test := \"/sys/fs/cgroup/.nomad-probe\"\n  if err := os.Mkdir(test, 0o755); err != nil { return fmt.Errorf(\"cgroup not writable: %w\", err) }\n  os.Remove(test)\n  return nil\n}","typeGuard":null,"tryCatchPattern":"if err := launchTask(); err != nil {\n  if strings.Contains(err.Error(), \"unable to configure cgroups\") {\n    log.Printf(\"cgroup isolation unavailable: %v — continuing without resource limits\", err)\n    return launchWithoutCgroups() // or fail fast if isolation is mandatory\n  }\n  return err\n}","preventionTips":["Verify cgroup controllers are mounted and not disabled via kernel cmdline","Run the client as root when cgroup isolation is required","Support cgroup v2 (upgrade) or force v1 consistently","Avoid read-only /sys/fs/cgroup mounts under the client"],"tags":["cgroups","resource-isolation","linux","nomad-executor"],"backgroundTag":"cgroup-configuration-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}