hashicorp/nomad · error

invalid cgroup permission string: %q

Error message

invalid cgroup permission string: %q

What it means

The Nomad Docker driver validates the Linux cgroup permission string applied to devices mapped into the container. In toDockerDevice, an empty CgroupPermissions is defaulted to "rwm" (read/write/mknod); any non-empty value that is not a valid combination of the characters r, w, m is rejected. This prevents invalid device cgroup rules from being sent to the Docker daemon.

Source

Thrown at drivers/docker/config.go:571

		PathInContainer:   d.ContainerPath,
		CgroupPermissions: d.CgroupPermissions,
	}

	if d.HostPath == "" {
		return dd, fmt.Errorf("host path must be set in configuration for devices")
	}

	// Docker's CLI defaults to HostPath in this case. See #16754
	if dd.PathInContainer == "" {
		dd.PathInContainer = d.HostPath
	}

	if dd.CgroupPermissions == "" {
		dd.CgroupPermissions = "rwm"
	}

	if !validateCgroupPermission(dd.CgroupPermissions) {
		return dd, fmt.Errorf("invalid cgroup permission string: %q", dd.CgroupPermissions)
	}

	return dd, nil
}

type DockerLogging struct {
	Type   string             `codec:"type"`
	Driver string             `codec:"driver"`
	Config hclutils.MapStrStr `codec:"config"`
}

type DockerHealthchecks struct {
	Disable bool `codec:"disable"`
}

func (dh *DockerHealthchecks) Disabled() bool {
	return dh == nil || dh.Disable
}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Change cgroup_permissions to a subset of the valid characters r, w, m only (e.g. "r", "rw", "rwm").
2. Remove cgroup_permissions entirely to get the default "rwm".
3. Check for accidental whitespace or quotes inside the string in the HCL/JSON job file.

Example fix

// before
devices = [{
  host_path = "/dev/video0"
  cgroup_permissions = "rw+m"
}]
// after
devices = [{
  host_path = "/dev/video0"
  cgroup_permissions = "rwm"
}]

func validCgroupPerm(s string) bool {
	if s == "" { return true }
	for _, c := range s {
		if c != 'r' && c != 'w' && c != 'm' { return false }
	}
	return true
}
// reject job spec if device.CgroupPermissions != "" && !validCgroupPerm(...)

func isCgroupPerm(s string) bool {
	for _, c := range s {
		switch c { case 'r', 'w', 'm': default: return false }
	}
	return true
}

When it happens

Trigger: A task's docker driver device block (or DockerDeviceRequest struct) sets cgroup_permissions to a string containing characters other than r/w/m, e.g. "rwmx", "R", or "r w" with spaces.

Common situations: Typo in a job spec device stanza, copy-pasting systemd device rules (like 'rwm' with extra chars) or Docker CLI --device-cgroup-rules syntax that differs from this driver's accepted format.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• does not match registry specification
• invalid mount type, must be "bind", "volume", "tmpfs": %q
• command empty: %q
• command contains extra white space: %q
• missing secret ID

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c0f73077e8567930. Report an issue: GitHub.