{"record":{"id":"c0f73077e8567930","repo":"hashicorp/nomad","slug":"invalid-cgroup-permission-string-q","errorCode":null,"errorMessage":"invalid cgroup permission string: %q","messagePattern":"invalid cgroup permission string: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/docker/config.go","lineNumber":571,"sourceCode":"\t\tPathInContainer:   d.ContainerPath,\n\t\tCgroupPermissions: d.CgroupPermissions,\n\t}\n\n\tif d.HostPath == \"\" {\n\t\treturn dd, fmt.Errorf(\"host path must be set in configuration for devices\")\n\t}\n\n\t// Docker's CLI defaults to HostPath in this case. See #16754\n\tif dd.PathInContainer == \"\" {\n\t\tdd.PathInContainer = d.HostPath\n\t}\n\n\tif dd.CgroupPermissions == \"\" {\n\t\tdd.CgroupPermissions = \"rwm\"\n\t}\n\n\tif !validateCgroupPermission(dd.CgroupPermissions) {\n\t\treturn dd, fmt.Errorf(\"invalid cgroup permission string: %q\", dd.CgroupPermissions)\n\t}\n\n\treturn dd, nil\n}\n\ntype DockerLogging struct {\n\tType   string             `codec:\"type\"`\n\tDriver string             `codec:\"driver\"`\n\tConfig hclutils.MapStrStr `codec:\"config\"`\n}\n\ntype DockerHealthchecks struct {\n\tDisable bool `codec:\"disable\"`\n}\n\nfunc (dh *DockerHealthchecks) Disabled() bool {\n\treturn dh == nil || dh.Disable\n}","sourceCodeStart":553,"sourceCodeEnd":589,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/drivers/docker/config.go#L553-L589","documentation":"The Nomad Docker driver validates the Linux cgroup permission string applied to devices mapped into the container. In toDockerDevice, an empty CgroupPermissions is defaulted to \"rwm\" (read/write/mknod); any non-empty value that is not a valid combination of the characters r, w, m is rejected. This prevents invalid device cgroup rules from being sent to the Docker daemon.","triggerScenarios":"A task's docker driver device block (or DockerDeviceRequest struct) sets cgroup_permissions to a string containing characters other than r/w/m, e.g. \"rwmx\", \"R\", or \"r w\" with spaces.","commonSituations":"Typo in a job spec device stanza, copy-pasting systemd device rules (like 'rwm' with extra chars) or Docker CLI --device-cgroup-rules syntax that differs from this driver's accepted format.","solutions":["Change cgroup_permissions to a subset of the valid characters r, w, m only (e.g. \"r\", \"rw\", \"rwm\").","Remove cgroup_permissions entirely to get the default \"rwm\".","Check for accidental whitespace or quotes inside the string in the HCL/JSON job file."],"exampleFix":"// before\ndevices = [{\n  host_path = \"/dev/video0\"\n  cgroup_permissions = \"rw+m\"\n}]\n// after\ndevices = [{\n  host_path = \"/dev/video0\"\n  cgroup_permissions = \"rwm\"\n}]","handlingStrategy":"validation","validationCode":"func validCgroupPerm(s string) bool {\n\tif s == \"\" { return true }\n\tfor _, c := range s {\n\t\tif c != 'r' && c != 'w' && c != 'm' { return false }\n\t}\n\treturn true\n}\n// reject job spec if device.CgroupPermissions != \"\" && !validCgroupPerm(...)","typeGuard":"func isCgroupPerm(s string) bool {\n\tfor _, c := range s {\n\t\tswitch c { case 'r', 'w', 'm': default: return false }\n\t}\n\treturn true\n}","tryCatchPattern":null,"preventionTips":["Only use characters from {r,w,m} in cgroup_permissions.","Omit the field when the default \"rwm\" is desired.","Don't copy systemd or Docker CLI cgroup rule syntax verbatim."],"tags":["docker","device","validation","nomad"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}