For cgroupv2, by default Docker uses a private namespace for cgroups. This is controlled by the --cgroupns flag for docker run and the default-cgroupns-mode daemon option. I need to create child cgroups within the container, but the problem is that the root cgroup within the container has an empty cgroup.subtree_control! I can't populate this within the container, since by the time the container is running, this root cgroup already has processes in it. Attempting to do so results in a "device or resource busy" error.

--cgroupns host would be a workaround, but it's just that — a workaround; it doesn't use the private namespace, which I would like to keep if possible. A further problem is that there's currently no way to set this from a compose file.

I looked into --cgroup-parent, which can be set via a compose file. However, I don't really understand this setting. I created a cgroup on the host, wrote to subtree_control, and then tried to start a container using that cgroup as the parent. I received this error, which I didn't understand:

error response from daemon: cgroup-parent for systemd cgroup should be a valid slice named as "xxx.slice"

I thought what this setting would do is change the "current cgroups directories" in the context of the following quote from the cgroup_namespaces manpage:

When a process creates a new cgroup namespace using clone(2) or unshare(2) with the CLONE_NEWCGROUP flag, its current cgroups directories become the cgroup root directories of the new namespace.

In any case, it is cumbersome to require a cgroup to be manually provisioned on the host before starting the container. What alternatives do I have to ensure cgroup.subtree_control in the container has the controllers I need enabled?

  • It turns out that for cgroup-parent I just had to append .slice to the cgroup's name. This solves the immediate error but not the main problem. The container's cgroup does get created within the parent I configured, but that child cgroup still has an empty subtree_control rather than inheriting it from its parent.
    – bgfvdu3w
    Dec 19, 2021 at 17:18

1 Answer 1


Create a child cgroup in the container, move every PID in /sys/fs/cgroup/cgroup.procs to the child, and then /sys/fs/cgroup/cgroup.subtree_control can be written to without any "device or resource busy" error.

  • would you please explain your solution? How we can create a new child cgroup? Sep 12, 2022 at 15:33
  • 1
    @MostafaGhadimi To create a child cgroup, create a new directory e.g. mkdir /sys/fs/cgroup/mychildgroup.
    – bgfvdu3w
    Sep 12, 2022 at 20:43
  • Thank you @bgfvdu3w Sep 12, 2022 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.