From 8a5fa88f6e0c19156fb78637a4d849dd7e94cd85 Mon Sep 17 00:00:00 2001
From: Sanjay Santhanam <51058514+Sanjays2402@users.noreply.github.com>
Date: Sat, 25 Jul 2026 14:35:10 -0700
Subject: [PATCH 1/2] Support the cgroup service field

The Compose Specification `cgroup` service field (`host` or `private`)
was silently dropped: `container_to_args` never read it, so a service
declaring `cgroup: host` was started in a private cgroup namespace
while docker-compose puts it in the host namespace.

Map the field onto `podman run --cgroupns`, and reject any other value
with a ValueError, mirroring how the neighbouring `ipc` option is
validated.

Added unit tests covering both valid modes and the invalid-value error.
---
 podman_compose.py                    |  6 +++++
 tests/unit/test_container_to_args.py | 33 ++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/podman_compose.py b/podman_compose.py
index 3a90cc0a..9fe9c9b8 100755
--- a/podman_compose.py
+++ b/podman_compose.py
@@ -1450,6 +1450,12 @@ async def container_to_args(
     if userns_mode is not None:
         podman_args.extend(["--userns", userns_mode])
 
+    cgroup = cnt.get("cgroup")
+    if cgroup is not None:
+        if cgroup not in ("host", "private"):
+            raise ValueError(f"invalid cgroup mode [{cgroup}]")
+        podman_args.extend(["--cgroupns", cgroup])
+
     user = cnt.get("user")
     if user is not None:
         podman_args.extend(["-u", user])
diff --git a/tests/unit/test_container_to_args.py b/tests/unit/test_container_to_args.py
index acc0b742..8c6e0c43 100644
--- a/tests/unit/test_container_to_args.py
+++ b/tests/unit/test_container_to_args.py
@@ -1228,6 +1228,39 @@ async def test_ipc_simple_modes(self, ipc_mode: str) -> None:
             ],
         )
 
+    @parameterized.expand(["host", "private"])
+    async def test_cgroup_modes(self, cgroup_mode: str) -> None:
+        """Pass the cgroup namespace mode on as --cgroupns parameter"""
+
+        c = create_compose_mock()
+
+        cnt = get_minimal_container()
+        cnt["cgroup"] = cgroup_mode
+
+        args = await container_to_args(c, cnt)
+        self.assertEqual(
+            args,
+            [
+                "--name=project_name_service_name1",
+                "-d",
+                "--network=bridge:alias=service_name",
+                "--cgroupns",
+                cgroup_mode,
+                "busybox",
+            ],
+        )
+
+    async def test_cgroup_invalid_mode(self) -> None:
+        """Throw ValueError on invalid cgroup mode"""
+
+        c = create_compose_mock()
+
+        cnt = get_minimal_container()
+        cnt["cgroup"] = "invalid"
+
+        with self.assertRaisesRegex(ValueError, r"invalid cgroup mode"):
+            await container_to_args(c, cnt)
+
     @parameterized.expand(["invalid", (["a list", "is invalid too"],)])
     async def test_ipc_invalid_mode(self, ipc_mode: Any) -> None:
         """Throw ValueError on invalid ipc mode"""

From b40659d0a20431cabaf19d4c3c59904075d5704a Mon Sep 17 00:00:00 2001
From: Sanjay Santhanam <51058514+Sanjays2402@users.noreply.github.com>
Date: Fri, 14 Aug 2026 23:55:12 -0700
Subject: [PATCH 2/2] docs: add cgroup service field release note

---
 newsfragments/cgroup-service-field.feature | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 newsfragments/cgroup-service-field.feature

diff --git a/newsfragments/cgroup-service-field.feature b/newsfragments/cgroup-service-field.feature
new file mode 100644
index 00000000..8aa33559
--- /dev/null
+++ b/newsfragments/cgroup-service-field.feature
@@ -0,0 +1 @@
+Add support for the Compose `cgroup` service field, passing `host` and `private` modes to Podman as `--cgroupns`.