Docker "cgroup: cannot enter cgroupv2" / cgroup Mount Errors in CI

runc could not place the container into a cgroup. On a cgroup v2 host the controllers may not be delegated to the environment Docker is running in - common inside nested or restricted runners.

What this error means

A docker run fails to start with a cgroup error: cannot enter cgroupv2, controller not available, or a runc cgroup-mount failure. The image is fine; the container cannot be placed in a cgroup.

docker run output

OCI runtime create failed: ... cgroup: cannot enter cgroupv2
"/sys/fs/cgroup/..." : no such file or directory: unknown

Common causes

cgroup controllers not delegated to the nested environment

Inside Docker-in-Docker or a constrained container, the cgroup v2 controllers may not be delegated, so runc cannot create the child cgroup it needs.

Host on cgroup v2 with tooling expecting v1

A runtime or tool built for cgroup v1 can misbehave on a pure cgroup v2 host, failing to set up the hierarchy correctly.

Missing cgroup filesystem mount

If /sys/fs/cgroup is not mounted (or mounted without the needed controllers) in the environment, the container cannot enter a cgroup.

How to fix it

Delegate cgroups to the nested runtime

For Docker-in-Docker, run the dind daemon with cgroup delegation / sufficient privileges so controllers are available.
Ensure /sys/fs/cgroup is mounted with the required controllers in the environment.
Prefer using the host’s Docker daemon over deeply nested runtimes.

Align the runtime with the host cgroup version

Check which cgroup version the host uses and use a compatible runc/runtime.

Terminal

# v2 hosts have this file; v1 hosts do not
cat /sys/fs/cgroup/cgroup.controllers 2>/dev/null && echo "cgroup v2"

How to prevent it

Use runner images where Docker and cgroup v2 are correctly configured.
Delegate cgroup controllers when running nested Docker.
Keep runc/containerd current so they handle cgroup v2 cleanly.