fix(envd): detect cgroup v2 filesystem before initializing Cgroup2Manager

packages/envd/internal/services/cgroups/cgroup2.go

@@ -51,6 +51,18 @@ func NewCgroup2Manager(opts ...Cgroup2ManagerOption) (*Cgroup2Manager, error) {
 		opt(&config)
 	}
 
+	// Verify cgroup v2 is available by checking the filesystem type.
+	// On cgroup v1, /sys/fs/cgroup is a tmpfs and directories/files can be
+	// created freely, causing Cgroup2Manager to "succeed" with invalid fds
+	// that the kernel rejects with EBADF on clone3(CLONE_INTO_CGROUP).
+	var st unix.Statfs_t
+	if err := unix.Statfs(config.rootPath, &st); err != nil {
+		return nil, fmt.Errorf("failed to statfs cgroup root %s: %w", config.rootPath, err)
+	}
+	if st.Type != unix.CGROUP2_SUPER_MAGIC {
+		return nil, fmt.Errorf("cgroup root %s is not a cgroup2 filesystem (type=0x%x)", config.rootPath, st.Type)
+	}
+
 	cgroupFDs, err := createCgroups(config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create cgroups: %w", err)

packages/envd/internal/services/cgroups/cgroup2_test.go

@@ -21,6 +21,15 @@ const (
 	megabyte = 1024 * kilobyte
 )
 
+func TestNewCgroup2Manager_NonCgroup2FS(t *testing.T) {
+	t.Parallel()
+
+	tmpDir := t.TempDir()
+	_, err := NewCgroup2Manager(WithCgroup2RootSysFSPath(tmpDir))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "not a cgroup2 filesystem")
+}
+
 func TestCgroupRoundTrip(t *testing.T) {
 	t.Parallel()
 

packages/envd/pkg/version.go

@@ -1,3 +1,3 @@
 package pkg
 
-const Version = "0.5.9"
+const Version = "0.5.10"