nektos/act · error

invalid device cgroup format '%s'

Error message

invalid device cgroup format '%s'

What it means

validateDeviceCgroupRule checks a --device-cgroup-rule value against the regexp for 'type major:minor mode' (e.g. 'c 1:3 mr'). If the string does not match, the original value is returned together with this error, mirroring Docker CLI behavior.

Source

Thrown at pkg/container/docker_cli.go:1058

	}

	return container.DeviceMapping{
		PathOnHost:        src,
		PathInContainer:   dst,
		CgroupPermissions: permissions,
	}, nil
}

// validateDeviceCgroupRule validates a device cgroup rule string format
// It will make sure 'val' is in the form:
//
//	'type major:minor mode'
func validateDeviceCgroupRule(val string) (string, error) {
	if deviceCgroupRuleRegexp.MatchString(val) {
		return val, nil
	}

	return val, fmt.Errorf("invalid device cgroup format '%s'", val)
}

// validDeviceMode checks if the mode for device is valid or not.
// Valid mode is a composition of r (read), w (write), and m (mknod).
func validDeviceMode(mode string) bool {
	legalDeviceMode := map[rune]bool{
		'r': true,
		'w': true,
		'm': true,
	}
	if mode == "" {
		return false
	}
	for _, c := range mode {
		if !legalDeviceMode[c] {
			return false
		}
		legalDeviceMode[c] = false

View on GitHub (pinned to 4f41128141)

Solutions

1. Use the exact form 'type major:minor mode', e.g. --device-cgroup-rule 'c 1:3 mr'
2. Type must be one of a/c/p (all, char, block); mode is a subset of rwm
3. If you want to expose a specific host device, use --device /dev/xyz instead
4. Validate the rule with a regex before running: echo "$rule" | grep -E '^[acp] [0-9]+:[0-9]+ [rwm]{1,3}$'

Example fix

# before
--device-cgroup-rule /dev/sda

# after
--device /dev/sda   # or a real rule: --device-cgroup-rule 'b 8:0 rm'

var deviceCgroupRuleRe = regexp.MustCompile(`^[acp] [0-9]+:[0-9]+ [rwm]{1,3}$`)
if !deviceCgroupRuleRe.MatchString(rule) { return fmt.Errorf("bad rule %q", rule) }

When it happens

Trigger: Passing --device-cgroup-rule with a malformed rule: wrong order ('1:3 c mr'), missing mode ('c 1:3'), invalid type letter ('x 1:3 mr'), or using a device path instead of a rule.

Common situations: Users confuse --device-cgroup-rule (cgroup-level allowance) with --device (mapping a specific host device) and pass a path like /dev/sda; or they transpose the fields from memory.

Related errors

• invalid device specification: %s
• --pid: invalid PID mode
• invalid storage option
• valid streams are STDIN, STDOUT and STDERR
• %s is not a valid mac address

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/f0259294883aedda. Report an issue: GitHub.