How to fix Error response from daemon: OCI runtime create failed: runsc error in Docker

What this error means

The "OCI runtime create failed: runsc error" message indicates that Docker attempted to start a container using gVisor's runsc runtime but encountered a failure during container creation. gVisor is a user-space kernel that provides an additional layer of isolation between containers and the host system by intercepting and handling system calls. When you configure Docker to use runsc as the runtime (instead of the default runc), Docker delegates container creation to gVisor. If runsc fails to initialize the sandbox, create the container filesystem, or set up the necessary isolation primitives, this error is thrown. The error is often accompanied by more specific details in Docker's error output or in runsc's debug logs, such as "operation not permitted," "invalid argument," or "cannot create sandbox." These details are crucial for diagnosing the root cause.

Typical symptoms

• Docker container fails to start with 'OCI runtime create failed' message
• Error message contains 'runsc' or references to gVisor components
• Containers work fine with default runc runtime but fail with runsc
• Container creation hangs before failing with timeout
• Debug logs show sandbox creation or namespace setup failures
• Error includes 'operation not permitted' or 'invalid argument'

Common causes

1. runsc binary not properly installed or not in system PATH
2. Docker daemon not configured correctly to use runsc runtime
3. Linux kernel version incompatible with gVisor requirements
4. SELinux or AppArmor blocking gVisor operations
5. Missing or incorrect runtime configuration in /etc/docker/daemon.json
6. Insufficient permissions for runsc to execute as unprivileged user
7. Kernel bug affecting gVisor (known issues in Linux 5.1-5.3.15, 5.4.2, 5.5)
8. containerd configuration format mismatch after updates
9. User namespaces not enabled or configured properly

How to fix "Error response from daemon: OCI runtime create failed: runsc error"

which runsc
runsc --version

# Add the gVisor repository key
curl -fsSL https://gvisor.dev/archive.key | sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg

# Add the repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] https://storage.googleapis.com/gvisor/releases release main" | sudo tee /etc/apt/sources.list.d/gvisor.list > /dev/null

# Install runsc
sudo apt-get update && sudo apt-get install -y runsc

ls -la $(which runsc)
# Should show: -rwxr-xr-x ... /usr/bin/runsc

{
  "runtimes": {
    "runsc": {
      "path": "/usr/bin/runsc"
    }
  }
}

{
  "runtimes": {
    "runsc": {
      "path": "/usr/bin/runsc",
      "runtimeArgs": [
        "--platform=systrap",
        "--network=sandbox"
      ]
    },
    "runsc-debug": {
      "path": "/usr/bin/runsc",
      "runtimeArgs": [
        "--debug-log=/tmp/runsc/",
        "--debug",
        "--strace"
      ]
    }
  }
}

sudo systemctl restart docker

docker info | grep -A5 "Runtimes"

uname -r

# Ubuntu/Debian
sudo apt-get update
sudo apt-get upgrade linux-generic

# Check for available kernels
apt list --installed | grep linux-image

cat /proc/sys/kernel/unprivileged_userns_clone
# Should return 1

sudo sysctl -w kernel.unprivileged_userns_clone=1
echo "kernel.unprivileged_userns_clone=1" | sudo tee /etc/sysctl.d/99-userns.conf

getenforce

docker run --runtime=runsc --security-opt label=disable <image>

sudo setenforce 0

services:
  myapp:
    runtime: runsc
    security_opt:
      - label:disable

{
  "runtimes": {
    "runsc-debug": {
      "path": "/usr/bin/runsc",
      "runtimeArgs": [
        "--debug-log=/tmp/runsc/",
        "--debug",
        "--strace"
      ]
    }
  }
}

sudo mkdir -p /tmp/runsc
sudo chmod 777 /tmp/runsc

sudo systemctl restart docker
docker run --runtime=runsc-debug hello-world

ls -la /tmp/runsc/
# Look for files ending in .create for container creation issues
# Files ending in .boot contain application syscall traces
cat /tmp/runsc/runsc.log.*.create

docker info | grep "rootless"

# runsc can re-execute itself
ls -la /proc/self/exe

# Verify cgroup v2 (unified hierarchy)
mount | grep cgroup
cat /sys/fs/cgroup/cgroup.controllers

{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "runtimes": {
    "runsc": {
      "path": "/usr/bin/runsc"
    }
  }
}

# Test basic functionality
docker run --runtime=runsc --rm hello-world

# Test with a simple shell
docker run --runtime=runsc --rm -it alpine:latest echo "gVisor working!"

# Run with strace to see which syscalls are failing
docker run --runtime=runsc-debug --rm your-image
cat /tmp/runsc/runsc.log.*.boot | grep -i "not implemented"

Advanced notes

{
  "runtimes": {
    "runsc-kvm": {
      "path": "/usr/bin/runsc",
      "runtimeArgs": ["--platform=kvm"]
    }
  }
}

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runsc]
  runtime_type = "io.containerd.runsc.v1"

docker run --runtime=runsc --gpus all nvidia/cuda:latest nvidia-smi

# Check system limits
ulimit -a
cat /proc/sys/fs/file-max

Frequently asked questions

What does "Error response from daemon: OCI runtime create failed: runsc error" mean?

The "OCI runtime create failed: runsc error" message indicates that Docker attempted to start a container using gVisor's runsc runtime but encountered a failure during container creation. gVisor is a user-space kernel that provides an additional layer of isolation between containers and the host system by intercepting and handling system calls. When you configure Docker to use runsc as the runtime (instead of the default runc), Docker delegates container creation to gVisor.

How do I fix "Error response from daemon: OCI runtime create failed: runsc error"?

This error occurs when Docker cannot start a container using gVisor's runsc runtime. Common causes include incorrect installation, misconfigured Docker daemon, kernel incompatibilities, or SELinux restrictions.

What causes "Error response from daemon: OCI runtime create failed: runsc error"?

runsc binary not properly installed or not in system PATH Docker daemon not configured correctly to use runsc runtime Linux kernel version incompatible with gVisor requirements

Is the "Error response from daemon: OCI runtime create failed: runsc error" error serious?

Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Related errors

• OCI runtime exec failed: exec failed: unable to start container process: exec: "curl": executable file not found in $PATH

  How to fix 'executable file not found in $PATH' in Docker healthcheck

  MEDIUM

• Error response from daemon: failed to get GCP credentials

  How to fix 'failed to get GCP credentials' in Docker

  HIGH

• health check command returned non-zero exit code: 1

  How to fix 'health check command returned non-zero exit code' in Docker

  MEDIUM

• failed to process "FROM ${BASE_IMAGE}": no build argument

  How to fix 'no build argument' for FROM in Docker

  MEDIUM

• WSL 2 requires an update to its kernel component

  How to fix 'WSL 2 requires an update to its kernel component' in Docker

  MEDIUM

• dial tcp: i/o timeout

  How to fix 'dial tcp: i/o timeout' in Docker

  MEDIUM

Official resources & further reading

• 📚Docker Official Documentation
• 📖
  gVisor Installation Guide(Official Docs)
• 📖
  gVisor Docker Quick Start(Official Docs)
• 📖
  gVisor Debugging Guide(Official Docs)
• 📖
  Docker Docs: Alternative Runtimes(Official Docs)
• 📖
  gVisor FAQ(Official Docs)
• 🐙
  GitHub: fork/exec operation not permitted(GitHub)
• 🐙
  GitHub: runsc runtime not working with CentOS(GitHub)
• 💬
  Stack Overflow: Cannot create sandbox EOF error(Stack Overflow)
• 📝
  Dev.to: 100 Common Docker Errors & Solutions