This is a misunderstanding, "systemd-escape" is not implementing the escaping logic that we use for generating cgroups paths. Instead it implements escaping for including arbitrary strings in unit names.

The escaping used for generating cgroup names is an internal implementation detail of systemd really. It's implemented here:

http://cgit.freedesktop.org/systemd/systemd/tree/src/shared/cgroup-util.c#n1443

(In reply to Lennart Poettering from comment #1)
> This is a misunderstanding, "systemd-escape" is not implementing the
> escaping logic that we use for generating cgroups paths. Instead it
> implements escaping for including arbitrary strings in unit names.
> 
> The escaping used for generating cgroup names is an internal implementation
> detail of systemd really. It's implemented here:
> 
> http://cgit.freedesktop.org/systemd/systemd/tree/src/shared/cgroup-util.
> c#n1443

Well, but how can i get my service cgroup from outside systemd code, in bash for example?
I previously used:
stat /sys/fs/cgroup/systemd/$(systemctl --user show -p ControlGroup tmux.service|sed 's/.*=//' )
but it doesn't work when service is running in container via nspawn service (systemctl start systemd-nspawn@grey.service)

Right now only way how i can get it is:
stat /sys/fs/cgroup/systemd/$(systemctl --user show -p ControlGroup tmux.service|sed 's/.*=//' | sed 's/x5c//' )

> stat /sys/fs/cgroup/systemd/$(systemctl --user show -p ControlGroup
> tmux.service|sed 's/.*=//' )

This is pretty good already. To get the missing prefix use the control group root that your PID 1 systemd instance is using, which you can query with:

systemctl -a show -p ControlGroup

i.e. don't specify a unit name, and you get the manager's properties. And do this for the system instance, not the user instance.

If you then concat the /sys/fs/cgroup prefix, with this PID1 cgroup root, with the unit path, then you should be good.

(In reply to Lennart Poettering from comment #3)
> > stat /sys/fs/cgroup/systemd/$(systemctl --user show -p ControlGroup
> > tmux.service|sed 's/.*=//' )
> 
> This is pretty good already. To get the missing prefix use the control group
> root that your PID 1 systemd instance is using, which you can query with:
> 
> systemctl -a show -p ControlGroup
> 
> i.e. don't specify a unit name, and you get the manager's properties. And do
> this for the system instance, not the user instance.
> 
> If you then concat the /sys/fs/cgroup prefix, with this PID1 cgroup root,
> with the unit path, then you should be good.

Yes, but it returns broken path even for container system manager:

% systemctl -a show -p ControlGroup
ControlGroup=/system.slice/system-systemd\x5cx2dnspawn.slice/systemd-nspawn@grey.service

But actually path is:
% find /sys/fs/cgroup/systemd/ -name '*nspawn.slice'
/sys/fs/cgroup/systemd/system.slice/system-systemd\x2dnspawn.slice

Note sure I understand what you are asking for?

Slices are simply a way to group scope or service units. Not sure why you are interested in that?