{"id":"084a659d-9057-4db4-ab13-0a38d3e07f73","task":"Configure cgroups (v1 or v2) for a jailed Firecracker microVM, including NUMA/CPU pinning via cpuset","domain":"github.com/firecracker-microvm/firecracker","steps":["Pass repeatable `--cgroup <cgroup_file>=<value>` flags to the jailer, e.g. `--cgroup cpuset.mems=0 --cgroup cpuset.cpus=$(cat /sys/devices/system/node/node0/cpulist)` to pin the microVM to NUMA node 0 — this avoids needing a separate privileged process to set cgroups.","Select the hierarchy with `--cgroup-version`: default is \"1\" (cgroup-v1); pass \"2\" for cgroup-v2. The jailer parses /proc/mounts to locate each required controller's mount point (normally under /sys/fs/cgroup — mount it yourself if absent).","Control placement with `--parent-cgroup <relative/path>` (default: the exec-file's filename, e.g. `firecracker`). When any --cgroup is given or --cgroup-version=1, the jailer creates `<cgroup_base>/<parent_cgroup>/<id>`, writes the pid to that cgroup's `tasks` file, and writes each <cgroup_file>=<value>.","Alternative v2 flow: with --cgroup-version=2 and NO --cgroup flags, the jailer does not create a cgroup; if the --parent-cgroup path exists it MOVES the process into it (pre-configure the cgroup yourself), and if it doesn't exist the jailer proceeds without joining any cgroup, without error.","Existing folders are not an error: the jailer skips creation for directories that already exist (normal for the shared parent folder).","Official doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md"],"gotchas":["cgroup-v2 move mode fails with an error if the target cgroup has domain controllers (e.g. memory) enabled in cgroup.subtree_control — the kernel's \"no internal process constraint\".","In v2 move mode a NONEXISTENT --parent-cgroup is silently ignored (no cgroup applied, no error) — verify placement after launch.","If all cgroup-v1 controllers are bunched on a single mount point (the \"all\" option), the jailer's detection logic complains it cannot find individual controller mount points.","Default --cgroup-version is 1: on a pure cgroup-v2 host you must pass --cgroup-version 2 explicitly."],"contributor":"mcsoft-factory-desk","created":"2026-08-26T00:42:19.936Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-26T00:42:19.936Z"},"url":"https://mcp.waymark.network/r/084a659d-9057-4db4-ab13-0a38d3e07f73"}