Reproduced on 3b95e7831b with Ubuntu, systemd 255 and cgroup v2. In the real dev app terminal, KIND_EXPERIMENTAL_PROVIDER=podman kind create cluster fails with the reported Delegate=yes error; its scope exposes only memory pids. A control scope launched with Delegate=yes passes that check and reaches node preparation, where this VM separately lacks /lib/modules. No matching duplicate found among open issues.
[Bug]: Agent systemd scopes lack cgroup Delegate — rootless kind/Podman fails inside agent sessions#21730
What happened
Linux agent processes launched via systemd-run --user --scope under app-t3code-agents*.slice only receive the memory and pids cgroup controllers. Nested rootless containers (kind with KIND_EXPERIMENTAL_PROVIDER=podman, Docker rootless, etc.) need cpu, cpuset, and io as well, and fail with errors like:
text
| 1 | ERROR: failed to create cluster: running kind with rootless provider requires systemd Delegate=yes |
The same workloads succeed outside a T3 agent session (e.g. a normal terminal, or a Cursor agent scope that already has full controllers).
Diagnosis
Comparing /sys/fs/cgroup/.../cgroup.controllers for a live agent scope showed only memory pids, while sibling user scopes (Cursor) had cpu cpuset io memory pids.
Agent scopes are created in apps/server/src/process/agentScope.ts without a valid systemd Delegate= assignment. An earlier attempt that used DelegateControllers= is rejected by systemd-run (Unknown assignment), so probes fall back to non-delegated options. systemd enables delegated controllers on ancestor slices when a scope starts with Delegate=; Delegate= cannot be set on slice units via systemctl set-property.
This is a regression versus earlier alphas that did not isolate agents in these scopes.
Steps to reproduce
- On Linux with cgroup v2 and a rootless container runtime (Podman or Docker rootless).
- Start a T3 Code agent session on a project that uses kind (e.g.
KIND_EXPERIMENTAL_PROVIDER=podman make deploy). - Observe kind fail with a Delegate / cgroup setup error.
- Run the same command in a normal user shell (outside the agent scope) — it succeeds when the host is otherwise configured for rootless kind.
Expected: agent sessions can run nested cgroup workloads the same way a normal user shell can.
Actual: agent scopes lack Delegate, so nested rootless containers cannot set up their cgroups.
Environment
- Linux (Fedora, cgroup v2), T3 Code desktop/server
- Rootless Podman + kind (
KIND_EXPERIMENTAL_PROVIDER=podman)
Fix / related PR
Proposed fix: pass --property=Delegate=cpu cpuset io memory pids on agent scope units (with probe fallback). systemd enables those controllers on ancestors when the scope starts.
PR: https://github.com/pingdotgg/t3code/pull/21700
Workaround
User drop-ins under ~/.config/systemd/user/ for t3code-.scope.d (and related) with Delegate=yes can unblock locally until the fix lands; prefer the PR once merged.