juicedata/juicefs · error

write %s to %s

Error message

write %s to %s

What it means

Wraps the failure of writing 'c 10:229 rwm' (the /dev/fuse device rule) into the cgroup v1 devices.allow file in grantAccess. Without a successful write the container is not permitted to use the FUSE device, and the wrapped error shows why (read-only cgroup or permissions).

Source

Thrown at pkg/fuse/device_linux.go:111

		}

		if (parts[0] == "c" || parts[0] == "a") && (parts[1] == "10:229" || parts[1] == "*:*") && parts[2] == "rwm" {
			logger.Debug("/dev/fuse is already granted")
			// fuse is already allowed
			return nil
		}
	}

	f, err := os.OpenFile(deviceAllowPath, os.O_WRONLY, 0)
	if err != nil {
		return errors.Wrapf(err, "open %s", deviceAllowPath)
	}
	defer f.Close()
	// 10, 229 according to https://www.kernel.org/doc/Documentation/admin-guide/devices.txt
	content := "c 10:229 rwm"
	_, err = f.WriteString(content)
	if err != nil {
		return errors.Wrapf(err, "write %s to %s", content, deviceAllowPath)
	}
	logger.Debug("/dev/fuse is granted")
	return nil
}

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Run as root with SYS_ADMIN and no restrictive LSM profile blocking cgroup writes
2. In Docker, use --privileged or add --device /dev/fuse so the write is unnecessary
3. Grant the device on the host instead (host-level udev rule or echo into the host cgroup)
4. Retry if a race with container startup/teardown caused ENOENT

Example fix

// before (AppArmor-restricted container)
docker run juicefs mount ...   // write c 10:229 rwm to ...devices.allow: operation not permitted
// after
docker run --privileged --device /dev/fuse juicefs mount ...

// check LSM/capabilities before attempting the write
if !hasCapSysAdmin() { // e.g. via capability package
  // write to devices.allow will be denied
}

if err := grantAccess(); err != nil && strings.Contains(err.Error(), "write c 10:229 rwm") {
  return fmt.Errorf("kernel denied devices.allow write (LSM/capabilities); grant /dev/fuse on the host: %w", err)
}

When it happens

Trigger: f.WriteString fails on devices.allow — typically EPERM/EACCES (process lacks rights even though the file opened), ENOENT if the cgroup was torn down between open and write, or EINVAL from a kernel rejecting the value.

Common situations: Containers where devices.allow opens but writes are denied by LSMs (AppArmor/SELinux); race with container teardown; restricted seccomp profiles blocking cgroup writes.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

• invalid cgroup entry: %q
• fail to find device cgroup
• read device list file
• invalid device list entry: %q
• open %s

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/6ac346961544f4fc. Report an issue: GitHub.