hashicorp/nomad · error

failed to create share cgroup: %w

Error message

failed to create share cgroup: %w

What it means

Init() creates the nomad.slice/share child cgroup used for all non-reserved tasks on cgroups v2. This error wraps a failure of os.MkdirAll creating that directory, meaning the share partition cannot be set up and task placement will fail.

Source

Thrown at client/lib/cgroupslib/init.go:168

			return fmt.Errorf("failed to create nomad cgroup: %w", err)
		}

		if err := writeCG(activation, NomadCgroupParent, subtreeFile); err != nil {
			return fmt.Errorf("failed to set subtree control on nomad cgroup: %w", err)
		}

		if err := writeCG(cores, NomadCgroupParent, cpusetFile); err != nil {
			return fmt.Errorf("failed to write root partition cpuset: %w", err)
		}

		log.Debug("top level partition root nomad.slice cgroup initialized")

		//
		// configuring nomad.slice/share (member)
		//

		if err := mkCG(NomadCgroupParent, SharePartition()); err != nil {
			return fmt.Errorf("failed to create share cgroup: %w", err)
		}

		if err := writeCG(activation, NomadCgroupParent, SharePartition(), subtreeFile); err != nil {
			return fmt.Errorf("failed to set subtree control on cpuset share partition: %w", err)
		}

		log.Debug("partition member nomad.slice/share cgroup initialized")

		//
		// configuring nomad.slice/reserve (member)
		//

		if err := mkCG(NomadCgroupParent, ReservePartition()); err != nil {
			return fmt.Errorf("failed to create share cgroup: %w", err)
		}

		if err := writeCG(activation, NomadCgroupParent, ReservePartition(), subtreeFile); err != nil {
			return fmt.Errorf("failed to set subtree control on cpuset reserve partition: %w", err)

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Ensure the agent can write under /sys/fs/cgroup/nomad.slice (run as root or configure systemd Delegate=yes).
2. Fix any earlier 'failed to create nomad cgroup' error so nomad.slice exists before share creation.
3. Confirm /sys/fs/cgroup is not mounted read-only; remount rw.
4. If running inside a container, run with privileged/host cgroup access (e.g. cgroupns=host).

Example fix

// before (docker run without cgroup access)
docker run hashicorp/nomad agent
// after
docker run --privileged -v /sys/fs/cgroup:/sys/fs/cgroup hashicorp/nomad agent

if err := syscall.Access("/sys/fs/cgroup", os.W_OK); err != nil {
  return fmt.Errorf("no write access to cgroup root: %w", err)
}
if _, err := os.Stat("/sys/fs/cgroup"); err != nil {
  return err
}

func cgroupTreeWritable(root string) bool {
  return syscall.Access(root, syscall.W_OK) == nil
}

if err := cgroupslib.Init(logger, cores); err != nil {
  if strings.Contains(err.Error(), "failed to create share cgroup") {
    logger.Error("verify cgroup write privileges and that nomad.slice was created")
  }
  return err
}

When it happens

Trigger: mkCG(NomadCgroupParent, SharePartition()) fails with EACCES (no permission to create directories under /sys/fs/cgroup/nomad.slice), EEXIST is treated as ok so usually EACCES/EINVAL, or the parent nomad.slice does not exist because an earlier Init step failed.

Common situations: Agent runs in a container without cgroup namespace write access; systemd delegation path mismatch so writes go to a read-only area; filesystem cgroup mounted read-only; leftover broken state where nomad.slice is missing but config assumes it.

Related errors

• failed to create share cpuset partition: %w
• failed to create reserve cpuset partition: %w
• failed to set subtree control on nomad cgroup: %w
• failed to write root partition cpuset: %w
• failed to set subtree control on cpuset share partition: %w

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/45465af1700d3c66. Report an issue: GitHub.