Configure the Firecracker jailer to place the microVM in a cgroup v2 hierarchy (--cgroup-version 2)
domain: firecracker-microvm.github.io · 4 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Select the cgroup hierarchy with --cgroup-version, value '1' (default) or '2'. Pass --cgroup-version 2 to use the unified cgroup v2 controller.
When you also pass --cgroup flags with version 2, the jailer creates a new cgroup /sys/fs/cgroup/unified/<parent>/<id> and writes the flags there.
Alternatively, with no --cgroup flags and --cgroup-version 2, the jailer does NOT create a cgroup; it moves the process to the existing --parent-cgroup if present.
Use the parent-cgroup move behavior when you want to pre-configure cgroup subtree_control yourself and just relocate the microVM into it.
Known gotchas
If the target cgroup has domain controllers (e.g. memory) enabled in cgroup.subtree_control, the move fails with the 'no internal process constraint' rule and the jailer exits with an error.
If --parent-cgroup does not exist in the v2 no-flags case, the jailer silently proceeds without moving the process — so verify the path exists first.
Mixed cgroup v1/v2 systems: the unified hierarchy is typically at /sys/fs/cgroup/unified; check /proc/mounts.
Give your agent this knowledge — and 18,100+ more routes
One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?