CreateContainerError: The container runtime failed to create the container

CreateContainerError means the pod's configuration resolved correctly but the container runtime could not create the container, often because of an entrypoint, mount, or permission problem.

Applies to: All Kubernetes versions, any container runtime

What it means

This status appears after configuration resolution has succeeded — so unlike CreateContainerConfigError, your ConfigMaps and Secrets are fine. The failure is at the runtime layer: containerd or CRI-O attempted to create the container and refused. The event message comes from the runtime rather than from Kubernetes, so it tends to be lower-level and more specific: a path that is not executable, a mount that collides with an existing file, a device that is unavailable, or a security policy that rejects the requested configuration.

Most common causes

• The command or entrypoint does not exist in the image, or is not executable.
• A volume mount path conflicts with an existing file or directory in the image.
• A hostPath mount points at a path that does not exist on the node.
• The container name collides with an existing container that was not cleaned up.
• A security context requests something the node or policy will not allow, such as a privileged container under a restrictive admission policy.
• The node is out of disk space or inodes, so the writable layer cannot be created.

How to diagnose it

1. Read the runtime's message: kubectl describe pod POD. It is usually specific — for example exec: "…": stat …: no such file or directory.
2. If it names a path, verify it exists in the image by running the image locally with an overridden entrypoint.
3. For mount conflicts, compare the mount paths in the pod spec against the image's own filesystem layout.
4. For hostPath mounts, check the path exists on the specific node the pod was scheduled to.
5. Check node disk pressure: kubectl describe node NODE and look at conditions.

How to fix it

1. Correct the command or entrypoint path, and ensure the binary is executable in the image.
2. Change the mount path so it does not collide with existing image content, or restructure the image.
3. Create the hostPath directory on the node, or replace hostPath with a volume type that does not depend on node layout.
4. Relax or correct the security context so it satisfies the cluster's admission policy.
5. Free disk space on the node if it is under pressure.

Notes

Because the message originates from the container runtime, the exact wording varies between containerd and CRI-O for the same underlying problem. Match on the substance rather than searching for the literal string.

Related

• CreateContainerConfigError — A referenced ConfigMap or Secret is missing
• RunContainerError — The container was created but failed to start

Sources

• Kubernetes documentation — Debug Pods
• Kubernetes documentation — Configure a Security Context for a Pod or Container
• Kubernetes documentation — Volumes