docker/cli · error

invalid device cgroup format

Error message

invalid device cgroup format '%s'

What it means

Thrown by validateDeviceCgroupRule when the value does not match the regex ^[acb] ([0-9]+|\*):([0-9]+|\*) [rwm]{1,3}$. The rule must be '<type> <major>:<minor> <mode>' where type is a/c/b, major/minor are numbers or '*', and mode is 1-3 chars from r/w/m.

Solutions

1. Match the exact format: type major:minor mode, e.g. 'c 1:5 rwm'
2. Use only r, w, m for the mode (no execute 'x')
3. Use '*' for wildcard major/minor: 'c *:* rwm'

Example fix

# before
docker run --device-cgroup-rule "c 1:5 rwx" ...
# after
docker run --device-cgroup-rule "c 1:5 rwm" ...

var cgroupRuleRe = regexp.MustCompile(`^[acb] ([0-9]+|\*):([0-9]+|\*) [rwm]{1,3}$`)

func validDeviceCgroupRule(rule string) bool {
    return cgroupRuleRe.MatchString(rule)
}

When it happens

Trigger: Calling `docker create/run --device-cgroup-rule <bad>` such as 'c 1:5 rwx' (x is invalid mode), 'x 1:5 rwm' (bad type), or 'c 1 rwm' (missing minor colon).

Common situations: Using 'rwx' instead of 'rwm'; forgetting the space between major:minor and mode; using uppercase type letter; omitting the colon; copy-pasting cgroup rules from /sys/fs/cgroup that use a different format.

Related errors

• got a device
• bad mode specified
• signer name " " must start with lowercase alphanumeric…
• other flags may not be combined with --rollback
• duplicate mount target

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/c4c2a4c6df6050dc. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/container/opts.go:1051

	}

	return container.DeviceMapping{
		PathOnHost:        src,
		PathInContainer:   dst,
		CgroupPermissions: permissions,
	}, nil
}

// validateDeviceCgroupRule validates a device cgroup rule string format
// It will make sure 'val' is in the form:
//
//	'type major:minor mode'
func validateDeviceCgroupRule(val string) (string, error) {
	if deviceCgroupRuleRegexp.MatchString(val) {
		return val, nil
	}

	return val, fmt.Errorf("invalid device cgroup format '%s'", val)
}

// validDeviceMode checks if the mode for device is valid or not.
// Valid mode is a composition of r (read), w (write), and m (mknod).
func validDeviceMode(mode string) bool {
	legalDeviceMode := map[rune]bool{
		'r': true,
		'w': true,
		'm': true,
	}
	if mode == "" {
		return false
	}
	for _, c := range mode {
		if !legalDeviceMode[c] {
			return false
		}
		legalDeviceMode[c] = false

View on GitHub (pinned to 4f84911bfe)