Repository navigation
Description
Windows Version
10.0.26300.9278
WSL Version
2.9.9.0 (Pre-release channel)
Full wsl --version:
WSL version: 2.9.9.0
Kernel version: 6.18.40.1-1
WSLg version: 1.0.79
MSRDC version: 1.2.7214
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.26100.1-240331-1435.ge-release
Windows version: 10.0.26300.9278
Are you using WSL 1 or WSL 2?
- WSL 2
Kernel Version
6.18.40.1-microsoft-standard-WSL2
Distro Version
Fedora Linux 44 (WSL). Also reproduced on Fedora Linux 42 (WSL) after upgrading WSL to 2.9.x.
Other Software
Docker CE rootless mode (dockerd-rootless), running as a systemctl --user service:
Docker version 29.7.2, build a7dcaa6
runc version 1.4.3
rootlesskit version 3.0.2
containerd containerd v2.3.4
Repro Steps
Rootless Docker (and, by the same root cause, rootless Podman) can no longer start any container after updating WSL to 2.9.x. The identical setup works on WSL 2.7.x.
-
On WSL 2.9.9 with systemd enabled, run rootless Docker as a user service (standard
dockerd-rootless-setuptool.sh install). -
Attempt to run any container as the (non-root) user:
$ docker run --rm hello-world docker: Error response from daemon: open /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers: no such file or directory
Setting a CPU limit fails the same way (the daemon reports no CFS support):
$ docker run --rm --cpus=1.0 hello-world docker: Error response from daemon: NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler or the cgroup is not mounted
Root cause (isolated)
WSL 2.9 relocated the entire cgroup v2 hierarchy under a per-distro root (/wsl-user/distro-<N>/…), leaving the standard top-level /sys/fs/cgroup/user.slice/… path that rootless Docker/rootlesskit expect absent:
# The path the rootless daemon looks for — MISSING:
$ ls /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers
ls: cannot access '/sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers': No such file or directory
# Where the cgroups actually live under 2.9:
$ cut -d: -f3 /proc/self/cgroup
/wsl-user/distro-282/non-systemd
$ systemctl show [email protected] -p ControlGroup --value
/wsl-user/distro-282/systemd/user.slice/user-1000.slice/[email protected]The following rule out the kernel and Docker as the cause:
-
Kernel supports CFS bandwidth and the interface exists (so this is not a missing kernel config):
$ zcat /proc/config.gz | grep CFS_BANDWIDTH CONFIG_CFS_BANDWIDTH=y $ ls /sys/fs/cgroup/wsl-user/distro-282/systemd/user.slice/user-1000.slice/[email protected]/cpu.max .../cpu.max # present
-
Rootful (system) Docker works, including CPU limits — isolating the fault to the rootless / systemd-user cgroup handling under WSL 2.9:
$ sudo docker run --rm --cpus=1.0 hello-world # succeeds -
I also observed more than one distro cgroup root appearing across sessions (
/wsl-user/distro-282/…and/wsl-user/distro-285/…), which suggests the per-distro cgroup subtree and controller delegation are not being set up consistently.
Expected Behavior
Rootless containers start and per-container resource limits (--cpus, etc.) work — the behavior on WSL 2.7.x. The standard cgroup v2 delegation (/sys/fs/cgroup/user.slice/user-<uid>.slice/… with the cpu/memory controllers delegated to user@<uid>.service) should be present so that rootlesskit/dockerd and podman operate normally.
Actual Behavior
After updating to WSL 2.9.x, rootless Docker cannot start any container. rootlesskit/dockerd fail resolving /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers (which no longer exists because the hierarchy was moved under /wsl-user/distro-<N>/…), and the daemon reports no CFS/CPU-quota support even though the kernel provides it. This is a regression from WSL 2.7.x, where the same rootless setup works. Related prior reports of rootless-container/systemd-user cgroup breakage on the WSL tracker: #13053, #13143.
Diagnostic Logs
Key values are inline above (wsl --version, kernel, /proc/self/cgroup, the missing path, and CONFIG_CFS_BANDWIDTH). I can attach a full collect-wsl-logs.ps1 bundle and strace of the failing dockerd/rootlesskit on request.
Activity
github-actions commentedon Sep 1, 2026
Logs are required for review from WSL team
If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.
How to collect WSL logs
Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:
The script will output the path of the log file once done.
If this is a networking issue, please use
.\collect-wsl-logs.ps1 -LogProfile networkinginstead, following the instructions in Collect WSL logs for networking issuesOnce completed please upload the output files to this GitHub issue.
See Collect WSL logs (recommended method).
If you choose to email these logs instead of attaching them to the bug, please send them to [email protected] with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.
josenobile commentedon Sep 1, 2026
/emailed-logs
github-actions commentedon Sep 1, 2026
Diagnostic information
josenobile commentedon Sep 1, 2026
Update — diagnostic logs emailed
The
collect-wsl-logs.ps1bundle has been captured on WSL 2.9.9.0 (kernel6.18.40.1-microsoft-standard-WSL2, Fedora 44) with a live reproduction of the failure inside the trace window, and emailed to[email protected]per the bot's instructions (/emailed-logsreply follows).Deterministic repro (100% on 2.9.x) — even a no-limit container fails:
Root cause — the standard cgroup path is absent because 2.9 relocated the hierarchy under
/wsl-user/distro-<N>/:Confirmed NOT the kernel and NOT Docker:
CONFIG_CFS_BANDWIDTH=y.--cpus— isolating the fault to the rootless /systemd --usercgroup delegation under 2.9.Contrast — WSL 2.7.12 (same distro/kernel line), everything works:
This pins the regression to the WSL 2.9 cgroup-hierarchy change: the standard top-level
/sys/fs/cgroup/user.slice/user-<uid>.slice/…(withcpu/memorydelegated touser@<uid>.service) is no longer presented, sorootlesskit/dockerd(and rootlesspodman, cf. #13053) cannot operate.github-actions commentedon Sep 1, 2026
Diagnostic information
chemwolf6922 commentedon Sep 1, 2026
Hi Jose Nobile (@josenobile) .
I'll look into it. You can disable the per-distro cgroup with this in your .wslconfig
The different cgroup name in different sessions is normal. As that number is the init's pid. And it is not supposed to be stable across boots.
chemwolf6922 commentedon Sep 1, 2026
Hi Jose Nobile (@josenobile) . I tested with podman. It's rootless mode works. The problem with docker is that it hard codes the user slice path regardless of where systemd is at.
chemwolf6922 commentedon Sep 1, 2026
I created an issue in moby to track this: moby/moby#53531
AkihiroSuda commentedon Sep 1, 2026
This issue will probably affect nerdctl and possibly other container engines too:
user.slicepath must not be hardcoded (affects WSL2.9) containerd/nerdctl#5172bricss commentedon Sep 5, 2026
I'm getting this error 🔴 on my side:
Error: crun: controller `pids` is not available under /sys/fs/cgroup/wsl-user/distro-252/machine.slice/libpod-c19754532653dcf8077450326754f140ec2a0fffa76e7f13cd2592ed86f1451d.scope/container/cgroup.controllers: OCI runtime error2.9.106.1.1w/ Fedora 44 (rootful)The only working ⚙️ solution right now:
podman run --cgroups=disabled IMAGEchemwolf6922 commentedon Sep 7, 2026
Hi Yahor Siarheyenka (@bricss) .
Could you inspect the layout from
/sys/fs/cgroup/to/sys/fs/cgroup/wsl-user/distro-<pid>/machine.sliceto see at which level did the controller went missing?Please also share the exact podman command and crun version that triggerd this. And if systemd is enabled for your distro.
A wsl log collection will also help diagnose this.
chemwolf6922 commentedon Sep 7, 2026
I created a build here https://github.com/chemwolf6922/build-wsl/actions/runs/34079611427 based on #41512. Please help verify if this build resolves any cgroup related issues.
Please note this is a dev build and may contain other issues. It's recommended to switch back to a release or pre-release version after the test.
bricss commentedon Sep 12, 2026
Here we go:⤵️
Literally any⚠️ unless
podman runcausing error--cgroups=disabledadded ➕ to it>_chemwolf6922 commentedon Sep 14, 2026
Hi Yahor Siarheyenka (@bricss) . Thanks for the info. This is an issue with how processes are arranged with the systemd-less boots. There are processes put into the distro-N group which prohibits the subgroup controllers to be enabled.
I updated that PR to resolve this. If you want to, please try out this dev build:
https://github.com/chemwolf6922/build-wsl/actions/runs/34798617405
Please note this is a dev build and may contain other issues. It's recommended to switch back to a release or pre-release version after the test.
l0rd commentedon Sep 22, 2026
I can still reproduce the problem after applying #41512.
I have tested by building WSL from the latest commit on master branch.
We have opened an issue Podman side and are evaluating turning off systemd delegation for cgroups on WSL.
I am testing on an ARM64 laptop.
l0rd commentedon Sep 23, 2026
For completeness, the Podman WSL distribution doesn't set
systemd=truein/etc/wsl.confbut starts systemd in a namespace (for historical reasons). We want to change that, and it would fix this problem too, but for now, systemd cgroup propagation seems broken for us.chemwolf6922 commentedon Sep 28, 2026
Hi Mario Loriedo (@l0rd) .
I think using the built-in systemd support would be the clean solution here.
Another method I can think of is to move the process to be execed into systemd to the distro root first and then exec systemd there. That's the rationale of me creating the
non-systemdlayer and putting things there.Since the distro namespace is no longer the real root, systemd won't be able to enable the sub-tree control when other processes still present in its cgroup. No matter if they are put in
/non-systemor/together.l0rd commentedon Sep 28, 2026
Feng Wang (@chemwolf6922) agreed
chemwolf6922 commentedon Nov 11, 2026
The original issue was fixed in 3.0.x released versions.
The podman desktop issue was fixed in podman v6.2.0.
chemwolf6922 commentedon Nov 11, 2026
According to this: podman-container-tools/podman#29837. Podman with wsl systemd support will be in 7.x versions.
ptrivedi commentedon Nov 11, 2026
Thanks for closing, Feng Wang (@chemwolf6922)
l0rd commentedon Nov 11, 2026
Podman v6.2.0 has WSL systemd support. We released it yesterday.