{"record":{"id":"dab70f188b79db47","repo":"hashicorp/nomad","slug":"failed-to-create-nomad-cgroup-s-w","errorCode":null,"errorMessage":"failed to create nomad cgroup %s: %w","messagePattern":"failed to create nomad cgroup (.+?): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"client/lib/cgroupslib/init.go","lineNumber":46,"sourceCode":"func Init(log hclog.Logger, cores string) error {\n\tlog.Info(\"initializing nomad cgroups\", \"cores\", cores)\n\n\tswitch GetMode() {\n\tcase CG1:\n\n\t\t// the value to disable inheriting values from parent cgroup\n\t\tconst noClone = \"0\"\n\n\t\t// the name of the clone_children interface file\n\t\tconst cloneFile = \"cgroup.clone_children\"\n\n\t\t// create the /nomad cgroup (or whatever the name is configured to be)\n\t\t// for each cgroup controller we are going to use\n\t\tcontrollers := []string{\"freezer\", \"memory\", \"cpu\", \"cpuset\"}\n\t\tfor _, ctrl := range controllers {\n\t\t\tp := filepath.Join(root, ctrl, NomadCgroupParent)\n\t\t\tif err := os.MkdirAll(p, 0755); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create nomad cgroup %s: %w\", ctrl, err)\n\t\t\t}\n\t\t}\n\n\t\t// determine the memset that will be set on the cgroup for each task\n\t\t//\n\t\t// nominally this will be all available but we have to read the root\n\t\t// cgroup to actually know what those are\n\t\t//\n\t\t// additionally if the nomad cgroup parent already exists, we must\n\t\t// use that memset instead, because it could have been setup out of\n\t\t// band from nomad itself\n\t\tvar memsSet string\n\t\tif mems, err := detectMemsCG1(); err != nil {\n\t\t\treturn fmt.Errorf(\"failed to detect memset: %w\", err)\n\t\t} else {\n\t\t\tmemsSet = mems\n\t\t}\n","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/client/lib/cgroupslib/init.go#L28-L64","documentation":"cgroupslib.Init fails when it cannot create the /nomad cgroup directory (NomadCgroupParent) under each required controller (freezer, memory, cpu, cpuset) via os.MkdirAll. This means Nomad cannot set up its cgroup hierarchy for task resource isolation and client startup aborts. The wrapped error names which controller failed.","triggerScenarios":"Running Init (cgroup v1 path via newCG1, or v2 via newCG2) where /sys/fs/cgroup/<controller>/nomad cannot be created: cgroup controller not mounted, read-only cgroup filesystem, rootless/insufficient privileges, or containers restricting cgroup writes.","commonSituations":"Nomad client running in a Docker container without cgroup namespace privileges; cgroup v1 controller not mounted (e.g. memory controller disabled at kernel boot with cgroup_disable=memory); /sys/fs/cgroup mounted read-only; running client as non-root on hosts requiring root; systemd delegating cgroups restrictively.","solutions":["Ensure the Nomad client runs as root (or with cgroup write privileges)","Check controllers are mounted: ls /sys/fs/cgroup (v1) and confirm freezer/memory/cpu/cpuset exist","Remove cgroup_disable=memory (and similar) from kernel cmdline and reboot","Remount cgroup filesystem read-write or fix the container runtime flags (--cgroupns=host, privileged)","Verify NomadCgroupParent doesn't collide with a file/improper path under the controller"],"exampleFix":"// before\n$ nomad agent -client  # as non-root: failed to create nomad cgroup memory: mkdir ... permission denied\n// after\n$ sudo nomad agent -client\n# or in Docker: docker run --privileged --cgroupns=host ...","handlingStrategy":"fallback","validationCode":"for _, c := range []string{\"freezer\", \"memory\", \"cpu\", \"cpuset\"} {\n    if _, err := os.Stat(filepath.Join(\"/sys/fs/cgroup\", c)); err != nil {\n        return fmt.Errorf(\"controller %s not mounted: %w\", c, err)\n    }\n}\nif err := syscall.Access(\"/sys/fs/cgroup\", os.O_RDWR); err != nil {\n    return fmt.Errorf(\"cgroupfs not writable (need root?): %w\", err)\n}","typeGuard":"func canManageCgroups() bool {\n    return os.Geteuid() == 0 && isMounted(\"/sys/fs/cgroup\")\n}","tryCatchPattern":"if err := cgroupslib.Init(cfg); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) {\n        log.Error(\"cgroup controller unavailable\", \"path\", perr.Path)\n        // fall back to cgroup-v2 mode or fail fast with clear operator guidance\n    }\n    return err\n}","preventionTips":["Run nomad agent as root on client nodes","Check kernel cmdline lacks cgroup_disable=memory / cpuset","In containers, run with --cgroupns=host and writable /sys/fs/cgroup","Verify controller mounts exist before starting the client"],"tags":["cgroups","linux","client-startup","permissions"],"backgroundTag":"cgroup-setup-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}