From 4bc7db5766af5d21a8cedbb8d5f6328ada90a59b Mon Sep 17 00:00:00 2001
From: CodeMaster4711 <cedi27@t-online.de>
Date: Sat, 8 Aug 2026 12:50:08 +0200
Subject: [PATCH] fix: correct cgroup path to jailer systemd scope, not a
 nonexistent parent-cgroup dir

---
 agent/src/firecracker/runtime.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/agent/src/firecracker/runtime.rs b/agent/src/firecracker/runtime.rs
index 4a9c9b5e..6e81fe0d 100644
--- a/agent/src/firecracker/runtime.rs
+++ b/agent/src/firecracker/runtime.rs
@@ -910,9 +910,10 @@ fn create_metrics_fifo(path: &Path) -> Result<()> {
 }
 
 fn cgroup_path(workload_id: &str) -> PathBuf {
+    let unit_name = jailer_unit_name(&jailer_short_id(workload_id));
     Path::new(CGROUP_ROOT)
-        .join(CGROUP_PARENT)
-        .join(jailer_short_id(workload_id))
+        .join("system.slice")
+        .join(format!("{}.service", unit_name))
 }
 
 async fn apply_port_dnat(workload_id: &str, guest_ip: &str, spec: &WorkloadSpec) -> Result<()> {