{"record":{"id":"d32d4daa1b119063","repo":"hashicorp/nomad","slug":"failed-to-set-clone-children-on-nomad-cpuset-cgrou","errorCode":null,"errorMessage":"failed to set clone_children on nomad cpuset cgroup: %w","messagePattern":"failed to set clone_children on nomad cpuset cgroup: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"client/lib/cgroupslib/init.go","lineNumber":81,"sourceCode":"\t\t}\n\n\t\t//\n\t\t// configure cpuset partitioning\n\t\t//\n\t\t// the tree is lopsided - tasks making use of reserved cpu cores get\n\t\t// their own cgroup with a static cpuset.cpus value. other tasks are\n\t\t// placed in the single share cgroup and share its dynamic cpuset.cpus\n\t\t// value\n\t\t//\n\t\t// e.g.,\n\t\t//  root/cpuset/nomad/\n\t\t//    share/{cgroup.procs, cpuset.cpus, cpuset.mems}\n\t\t//    reserve/\n\t\t//      abc123.task/{cgroup.procs, cpuset.cpus, cpuset.mems}\n\t\t//      def456.task/{cgroup.procs, cpuset.cpus, cpuset.mems}\n\n\t\tif err := writeCG(noClone, \"cpuset\", NomadCgroupParent, cloneFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set clone_children on nomad cpuset cgroup: %w\", err)\n\t\t}\n\n\t\tif err := writeCG(memsSet, \"cpuset\", NomadCgroupParent, memsFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to set cpuset.mems on nomad cpuset cgroup: %w\", err)\n\t\t}\n\n\t\tif err := writeCG(cores, \"cpuset\", NomadCgroupParent, cpusetFile); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to write cores to nomad cpuset cgroup: %w\", err)\n\t\t}\n\n\t\t//\n\t\t// share partition\n\t\t//\n\n\t\tif err := mkCG(\"cpuset\", NomadCgroupParent, SharePartition()); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create share cpuset partition: %w\", err)\n\t\t}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/cgroupslib/init.go#L63-L99","documentation":"cgroupslib.Init fails when writeCG cannot write the clone_children flag (cgroup.clone_children = 1) to the Nomad cpuset cgroup. Nomad sets CLONE_CHILDREN so child cgroups inherit cpus/mems; failure here means the Nomad cgroup hierarchy cannot be configured and client startup aborts.","triggerScenarios":"Init (cgroup v1 path, newCG1) invokes writeCG(noClone, \"cpuset\", NomadCgroupParent, cloneFile) and the write fails: /sys/fs/cgroup/cpuset/nomad/cgroup.clone_children missing or read-only, or insufficient permissions to write.","commonSituations":"The nomad cgroup directory was created but cgroupfs is mounted read-only; client in a restricted container; another process (systemd) changed cgroup ownership/permissions; kernel lacking clone_children support (very old kernels); SELinux/AppArmor denying cgroup writes.","solutions":["Check the wrapped error (%w) for ENOENT vs EACCES vs EROFS and address accordingly","Remount cgroupfs read-write or ensure the client runs with sufficient privileges","Recreate the /sys/fs/cgroup/cpuset/nomad directory if missing","Check SELinux/AppAudit policies denying writes to cgroup files (ausearch/sealert)","Avoid external managers (systemd delegation) claiming Nomad's cgroup parent"],"exampleFix":"// before\n$ mount | grep cgroup  # cgroup mounted ro\n// after\n$ sudo mount -o remount,rw /sys/fs/cgroup\n$ echo 1 > /sys/fs/cgroup/cpuset/nomad/cgroup.clone_children","handlingStrategy":"validation","validationCode":"f := \"/sys/fs/cgroup/cpuset/nomad/cgroup.clone_children\"\nif err := os.WriteFile(f, []byte(\"1\"), 0644); err != nil {\n    return fmt.Errorf(\"cannot write clone_children at %s: %w\", f, err)\n}","typeGuard":"func cloneChildrenWritable() bool {\n    fi, err := os.Stat(\"/sys/fs/cgroup/cpuset/nomad/cgroup.clone_children\")\n    return err == nil && fi.Mode().Perm()&0o200 != 0\n}","tryCatchPattern":"if err := cgroupslib.Init(cfg); err != nil {\n    if strings.Contains(err.Error(), \"failed to set clone_children\") {\n        log.Error(\"cgroupfs read-only or permissions denied; remount rw or run as root\")\n        return err\n    }\n    return err\n}","preventionTips":["Ensure /sys/fs/cgroup is mounted read-write for the nomad client","Run the client as root so it can write cgroup control files","Keep systemd or other managers from claiming Nomad's cgroup parent","Check SELinux/AppArmor policies allow cgroup writes"],"tags":["cgroups","cpuset","client-startup","permissions"],"backgroundTag":"cgroup-setup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}