# \[Bug\]: Agent systemd scopes lack cgroup Delegate — rootless kind/Podman fails inside agent sessions · Issue \#21730 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/issues/21730)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: backlog

Priority: 0

## Description

[Discussion and activity](https://git.cafe/pingdotgg/t3code/issues/21730)

---

### What happened

Linux agent processes launched via `systemd-run --user --scope` under `app-t3code-agents*.slice` only receive the `memory` and `pids` cgroup controllers. Nested rootless containers (kind with `KIND_EXPERIMENTAL_PROVIDER=podman`, Docker rootless, etc.) need `cpu`, `cpuset`, and `io` as well, and fail with errors like:

```text
ERROR: failed to create cluster: running kind with rootless provider requires systemd Delegate=yes
```

The same workloads succeed outside a T3 agent session (e.g. a normal terminal, or a Cursor agent scope that already has full controllers).

### Diagnosis

Comparing `/sys/fs/cgroup/.../cgroup.controllers` for a live agent scope showed only `memory pids`, while sibling user scopes (Cursor) had `cpu cpuset io memory pids`.

Agent scopes are created in `apps/server/src/process/agentScope.ts` without a valid systemd `Delegate=` assignment. An earlier attempt that used `DelegateControllers=` is rejected by `systemd-run` (`Unknown assignment`), so probes fall back to non-delegated options. systemd enables delegated controllers on ancestor slices when a **scope** starts with `Delegate=`; `Delegate=` cannot be set on slice units via `systemctl set-property`.

This is a regression versus earlier alphas that did not isolate agents in these scopes.

### Steps to reproduce

1. On Linux with cgroup v2 and a rootless container runtime (Podman or Docker rootless).
2. Start a T3 Code agent session on a project that uses kind (e.g. `KIND_EXPERIMENTAL_PROVIDER=podman make deploy`).
3. Observe kind fail with a Delegate / cgroup setup error.
4. Run the same command in a normal user shell (outside the agent scope) — it succeeds when the host is otherwise configured for rootless kind.

Expected: agent sessions can run nested cgroup workloads the same way a normal user shell can.

Actual: agent scopes lack `Delegate`, so nested rootless containers cannot set up their cgroups.

### Environment

- Linux (Fedora, cgroup v2), T3 Code desktop/server
- Rootless Podman + kind (`KIND_EXPERIMENTAL_PROVIDER=podman`)

### Fix / related PR

Proposed fix: pass `--property=Delegate=cpu cpuset io memory pids` on agent scope units (with probe fallback). systemd enables those controllers on ancestors when the scope starts.

**PR:** https://github.com/pingdotgg/t3code/pull/21700

### Workaround

User drop-ins under `~/.config/systemd/user/` for `t3code-.scope.d` (and related) with `Delegate=yes` can unblock locally until the fix lands; prefer the PR once merged.