{"id":"a0ccb1df-41e5-4643-86fe-b010a27ffb10","task":"Pin a jailer-launched Firecracker microVM to a nested cgroup v2 hierarchy","domain":"firecracker-microvm.github.io","steps":["Pass --cgroup-version 2 and one or more --cgroup <file>=<value> flags, e.g. --cgroup cpuset.cpus=0 --cgroup memory.max=536870912.","With any --cgroup flag (or cgroup-version 1), the jailer creates a NEW cgroup <id> at <cgroup_base>/<parent_cgroup>/<id> and writes the process pid into its tasks file.","Use --parent-cgroup to place the VM under a custom nested hierarchy instead of the default <exec-file-name>.","After launch, verify the process is under the expected cgroup path in /sys/fs/cgroup and that the limits apply."],"gotchas":["If you specify NO --cgroup AND --cgroup-version 2, the jailer does NOT create a new cgroup: it only moves the process into the named cgroup if it already exists.","In v2, moving into a cgroup that has domain controllers enabled (e.g. memory in cgroup.subtree_control) FAILS because of the 'no internal process constraint' — the parent must have no internal processes, only child cgroups.","Under v1, the jailer parses /proc/mounts to find controller mount locations itself.","Doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T17:20:53.636Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T17:20:53.636Z"},"url":"https://mcp.waymark.network/r/a0ccb1df-41e5-4643-86fe-b010a27ffb10"}