{"record":{"id":"c4c2a4c6df6050dc","repo":"docker/cli","slug":"invalid-device-cgroup-format-s","errorCode":null,"errorMessage":"invalid device cgroup format '%s'","messagePattern":"invalid device cgroup format '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/container/opts.go","lineNumber":1051,"sourceCode":"\t}\n\n\treturn container.DeviceMapping{\n\t\tPathOnHost:        src,\n\t\tPathInContainer:   dst,\n\t\tCgroupPermissions: permissions,\n\t}, nil\n}\n\n// validateDeviceCgroupRule validates a device cgroup rule string format\n// It will make sure 'val' is in the form:\n//\n//\t'type major:minor mode'\nfunc validateDeviceCgroupRule(val string) (string, error) {\n\tif deviceCgroupRuleRegexp.MatchString(val) {\n\t\treturn val, nil\n\t}\n\n\treturn val, fmt.Errorf(\"invalid device cgroup format '%s'\", val)\n}\n\n// validDeviceMode checks if the mode for device is valid or not.\n// Valid mode is a composition of r (read), w (write), and m (mknod).\nfunc validDeviceMode(mode string) bool {\n\tlegalDeviceMode := map[rune]bool{\n\t\t'r': true,\n\t\t'w': true,\n\t\t'm': true,\n\t}\n\tif mode == \"\" {\n\t\treturn false\n\t}\n\tfor _, c := range mode {\n\t\tif !legalDeviceMode[c] {\n\t\t\treturn false\n\t\t}\n\t\tlegalDeviceMode[c] = false","sourceCodeStart":1033,"sourceCodeEnd":1069,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/container/opts.go#L1033-L1069","documentation":"Thrown by validateDeviceCgroupRule when the value does not match the regex ^[acb] ([0-9]+|\\*):([0-9]+|\\*) [rwm]{1,3}$. The rule must be '<type> <major>:<minor> <mode>' where type is a/c/b, major/minor are numbers or '*', and mode is 1-3 chars from r/w/m.","triggerScenarios":"Calling `docker create/run --device-cgroup-rule <bad>` such as 'c 1:5 rwx' (x is invalid mode), 'x 1:5 rwm' (bad type), or 'c 1 rwm' (missing minor colon).","commonSituations":"Using 'rwx' instead of 'rwm'; forgetting the space between major:minor and mode; using uppercase type letter; omitting the colon; copy-pasting cgroup rules from /sys/fs/cgroup that use a different format.","solutions":["Match the exact format: type major:minor mode, e.g. 'c 1:5 rwm'","Use only r, w, m for the mode (no execute 'x')","Use '*' for wildcard major/minor: 'c *:* rwm'"],"exampleFix":"# before\ndocker run --device-cgroup-rule \"c 1:5 rwx\" ...\n# after\ndocker run --device-cgroup-rule \"c 1:5 rwm\" ...","handlingStrategy":"validation","validationCode":"var cgroupRuleRe = regexp.MustCompile(`^[acb] ([0-9]+|\\*):([0-9]+|\\*) [rwm]{1,3}$`)\n\nfunc validDeviceCgroupRule(rule string) bool {\n    return cgroupRuleRe.MatchString(rule)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the canonical regex near where rules are generated so callers reuse it","Remember mode is rwm, never includes 'x'"],"tags":["docker","device","cgroup","validation","regex"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}