juicedata/juicefs · error

invalid cgroup entry: %q

Error message

invalid cgroup entry: %q

What it means

grantAccess scans /proc/self/cgroup to locate the device cgroup controller so it can grant access to /dev/fuse. Each line must have the form hierarchy-id:controller-list:cgroup-path (at least 3 colon-separated fields). If a line splits into fewer than 3 parts, the entry is malformed and the scan aborts with this error.

Source

Thrown at pkg/fuse/device_linux.go:61

	cgroupPath := fmt.Sprintf("/proc/%d/cgroup", pid)
	cgroupFile, err := os.Open(cgroupPath)
	if err != nil {
		return errors.Wrapf(err, "open %s", cgroupPath)
	}
	defer cgroupFile.Close()

	cgroupScanner := bufio.NewScanner(cgroupFile)
	var deviceCgroup string
	for cgroupScanner.Scan() {
		if err := cgroupScanner.Err(); err != nil {
			return errors.Wrap(err, "read cgroup file")
		}
		var (
			text  = cgroupScanner.Text()
			parts = strings.SplitN(text, ":", 3)
		)
		if len(parts) < 3 {
			return errors.Errorf("invalid cgroup entry: %q", text)
		}

		if parts[1] == "devices" {
			deviceCgroup = parts[2]
		}
	}

	if len(deviceCgroup) == 0 {
		return errors.Errorf("fail to find device cgroup")
	}

	deviceListPath := path.Join("/sys/fs/cgroup/devices" + deviceCgroup, "/devices.list")
	deviceAllowPath := path.Join("/sys/fs/cgroup/devices" + deviceCgroup, "/devices.allow")

	// check if fuse is already allowed
	deviceListFile, err := os.OpenFile(deviceListPath, os.O_RDONLY, 0)
	if err != nil {
		return errors.Wrapf(err, "open %s", deviceListPath)

View on GitHub (pinned to c9a67b23e8)

Solutions

  1. Check 'cat /proc/self/cgroup' on the host where the mount runs and confirm every line has the standard 3-field colon-separated format
  2. Run the mount on a host where /proc/self/cgroup is standard (cgroup v1 with controllers, or standard cgroup v2 '0::/path' lines)
  3. Grant the FUSE device manually (write 'c 10:229 rwm' to the container's devices.allow, or use --device=/dev/fuse --cap-add SYS_ADMIN in Docker) so grantAccess is not required
  4. Upgrade to a JuiceFS version handling the environment's cgroup layout

Example fix

// before (custom runtime faking cgroup file)
./juicefs mount redis://host/1 /mnt/jfs
// error: invalid cgroup entry: "bogusline"
// after (docker with explicit device access)
docker run --device /dev/fuse --cap-add SYS_ADMIN juicefs mount ...
Defensive patterns

Strategy: validation

Validate before calling

if data, err := os.ReadFile("/proc/self/cgroup"); err == nil {
  for _, line := range strings.Split(string(data), "\n") {
    if line != "" && strings.Count(line, ":") < 2 {
      // malformed cgroup entry; grantAccess will fail — grant device manually
    }
  }
}

Type guard

func cgroupEntriesWellFormed(cgroupFile string) bool {
  data, err := os.ReadFile(cgroupFile)
  if err != nil { return false }
  for _, line := range strings.Split(string(data), "\n") {
    if line == "" { continue }
    if len(strings.SplitN(line, ":", 3)) < 3 { return false }
  }
  return true
}

Try / catch

if err := grantAccess(); err != nil && strings.Contains(err.Error(), "invalid cgroup entry") {
  // fall back to manual device grant or warn and continue
  logger.Warnf("cgroup device grant skipped: %v", err)
}

Prevention

When it happens

Trigger: Running a JuiceFS mount inside a container or host where /proc/self/cgroup contains a line without two ':' separators — e.g. non-standard formats emitted by custom container runtimes or unusual cgroup configurations.

Common situations: Mounting JuiceFS inside Docker/Kubernetes pods; minimal containers with abbreviated cgroup files; custom runtimes (gVisor, Kata) that fake /proc/self/cgroup with unexpected formats.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/2029b61586219701. Report an issue: GitHub.