{"record":{"id":"f0259294883aedda","repo":"nektos/act","slug":"invalid-device-cgroup-format-s","errorCode":null,"errorMessage":"invalid device cgroup format '%s'","messagePattern":"invalid device cgroup format '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/container/docker_cli.go","lineNumber":1058,"sourceCode":"\t}\n\n\treturn container.DeviceMapping{\n\t\tPathOnHost:        src,\n\t\tPathInContainer:   dst,\n\t\tCgroupPermissions: permissions,\n\t}, nil\n}\n\n// validateDeviceCgroupRule validates a device cgroup rule string format\n// It will make sure 'val' is in the form:\n//\n//\t'type major:minor mode'\nfunc validateDeviceCgroupRule(val string) (string, error) {\n\tif deviceCgroupRuleRegexp.MatchString(val) {\n\t\treturn val, nil\n\t}\n\n\treturn val, fmt.Errorf(\"invalid device cgroup format '%s'\", val)\n}\n\n// validDeviceMode checks if the mode for device is valid or not.\n// Valid mode is a composition of r (read), w (write), and m (mknod).\nfunc validDeviceMode(mode string) bool {\n\tlegalDeviceMode := map[rune]bool{\n\t\t'r': true,\n\t\t'w': true,\n\t\t'm': true,\n\t}\n\tif mode == \"\" {\n\t\treturn false\n\t}\n\tfor _, c := range mode {\n\t\tif !legalDeviceMode[c] {\n\t\t\treturn false\n\t\t}\n\t\tlegalDeviceMode[c] = false","sourceCodeStart":1040,"sourceCodeEnd":1076,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/container/docker_cli.go#L1040-L1076","documentation":"validateDeviceCgroupRule checks a --device-cgroup-rule value against the regexp for 'type major:minor mode' (e.g. 'c 1:3 mr'). If the string does not match, the original value is returned together with this error, mirroring Docker CLI behavior.","triggerScenarios":"Passing --device-cgroup-rule with a malformed rule: wrong order ('1:3 c mr'), missing mode ('c 1:3'), invalid type letter ('x 1:3 mr'), or using a device path instead of a rule.","commonSituations":"Users confuse --device-cgroup-rule (cgroup-level allowance) with --device (mapping a specific host device) and pass a path like /dev/sda; or they transpose the fields from memory.","solutions":["Use the exact form 'type major:minor mode', e.g. --device-cgroup-rule 'c 1:3 mr'","Type must be one of a/c/p (all, char, block); mode is a subset of rwm","If you want to expose a specific host device, use --device /dev/xyz instead","Validate the rule with a regex before running: echo \"$rule\" | grep -E '^[acp] [0-9]+:[0-9]+ [rwm]{1,3}$'"],"exampleFix":"# before\n--device-cgroup-rule /dev/sda\n\n# after\n--device /dev/sda   # or a real rule: --device-cgroup-rule 'b 8:0 rm'","handlingStrategy":"validation","validationCode":"var deviceCgroupRuleRe = regexp.MustCompile(`^[acp] [0-9]+:[0-9]+ [rwm]{1,3}$`)\nif !deviceCgroupRuleRe.MatchString(rule) { return fmt.Errorf(\"bad rule %q\", rule) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Memorize the form 'type major:minor mode' (c 1:3 mr)","Use --device for concrete devices, --device-cgroup-rule only for cgroup allowances"],"tags":["docker","device-cgroup","flag-parsing","validation"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}