How to fix OCI runtime create failed: container init process failed in Docker

DockerINTERMEDIATEHIGHUpdated Dec 6, 2025· 276 views

This error occurs when the container runtime (runc) fails to initialize and start your container process. Common causes include missing executables, incorrect file permissions, invalid entrypoints, or Docker version incompatibilities.

Quick fix

Fixes OCI runtime create failed: container init process failed

docker run your-image 2>&1 | tail -20
  1. Read the complete error message
  2. Verify entrypoint and command exist in the image
  3. Check for Windows line endings (CRLF)
  4. Ensure scripts have execute permissions
docker — error
docker run your-image 2>&1 | tail -20
OCI runtime create failed: container init process failed

What this error means

The "OCI runtime create failed: container init process failed" error indicates that Docker's underlying container runtime (runc) was unable to start the init process inside the container. This happens during the container creation phase, before your application even begins running. OCI (Open Container Initiative) defines the standard for container runtimes. When Docker tries to start a container, it delegates to runc, which sets up the container's namespaces, cgroups, and filesystem, then executes the init process (your ENTRYPOINT or CMD). If any of these steps fail, you get this error. The error message is often followed by more specific details about what went wrong—such as "executable file not found", "permission denied", or "exec format error". Reading the complete error message is crucial for diagnosis.

Typical symptoms

  • Container fails to start immediately with OCI runtime error
  • docker run or docker-compose up exits with an error before container runs
  • Error appears during CI/CD pipeline container start steps
  • Container works with docker build but fails on docker run
  • Error message includes 'runc create failed' or 'unable to start container process'
  • Previously working containers suddenly fail after Docker or system updates

Common causes

  1. Executable specified in ENTRYPOINT or CMD not found in the container image (most common)
  2. Shell script has incorrect line endings (CRLF instead of LF)
  3. Missing execute permissions on the entrypoint script
  4. Outdated Docker version with incompatible runc
  5. Invalid or corrupted container image
  6. AppArmor or SELinux security policies blocking execution
  7. Incompatible CPU architecture (e.g., running arm64 image on amd64)
  8. MountFlags=slave in Docker systemd service causing mount issues
  9. cgroup configuration errors (especially on Kubernetes/EKS)
  10. WSL version mismatch on Windows (WSL1 instead of WSL2)

How to fix "OCI runtime create failed: container init process failed"

1Read the complete error message

The OCI runtime error is usually followed by more specific information. Look for the trailing part of the error:

bash
docker run your-image 2>&1 | tail -20

Common trailing messages and their meanings:
- executable file not found in $PATH - Missing binary
- permission denied - File permission issue
- exec format error - Wrong architecture or shebang issue
- no such file or directory - Missing file or bad line endings
- read-only file system - Volume mount issue

2Verify entrypoint and command exist in the image

Inspect the image to see what command it's trying to run:

bash
docker inspect --format='Entrypoint={{.Config.Entrypoint}} Cmd={{.Config.Cmd}}' your-image

Then verify the executable exists inside the image:

bash
# Start a shell in the image (if available)
docker run --rm -it --entrypoint /bin/sh your-image -c "which your-command"

# Or list files in the expected path
docker run --rm -it --entrypoint /bin/sh your-image -c "ls -la /path/to/entrypoint"

If using a minimal base image like alpine or scratch, ensure all required binaries are present.

3Check for Windows line endings (CRLF)

Shell scripts created on Windows often have CRLF line endings that cause "no such file or directory" errors on Linux:

bash
# Check for CRLF in your script
file entrypoint.sh
# Or
cat -v entrypoint.sh | head -5  # Look for ^M characters

Fix: Convert to Unix line endings:

bash
# Using dos2unix
dos2unix entrypoint.sh

# Or using sed
sed -i 's/\r$//' entrypoint.sh

# Or in Dockerfile
RUN sed -i 's/\r$//' /entrypoint.sh

Prevent future issues: Configure Git to handle line endings:

bash
git config --global core.autocrlf input
4Ensure scripts have execute permissions

Scripts need execute permissions to run. Add this to your Dockerfile:

dockerfile
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

Or fix permissions before building:

bash
chmod +x entrypoint.sh
git update-index --chmod=+x entrypoint.sh  # Preserve in Git
5Update Docker to the latest version

Outdated Docker versions can have runc compatibility issues. Docker 25+ resolves many OCI runtime issues:

bash
# Check current version
docker version

# Update on Ubuntu/Debian
sudo apt update && sudo apt upgrade docker-ce docker-ce-cli containerd.io

# Update on CentOS/RHEL
sudo yum update docker-ce docker-ce-cli containerd.io

After updating, restart Docker:

bash
sudo systemctl restart docker
6Clean up Docker state and try again

Corrupted containers or images can cause this error. Clean up and retry:

bash
# Stop all containers
docker stop $(docker ps -aq) 2>/dev/null

# Remove stopped containers
docker container prune -f

# Remove unused images
docker image prune -a -f

# Restart Docker daemon
sudo systemctl restart docker

# Try running your container again
docker run your-image
7Test with security options disabled

If AppArmor or SELinux is causing the issue, test by temporarily disabling security confinement:

bash
docker run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined your-image

Warning: Only use this for testing. If it works, investigate the proper security policy fix rather than running production containers without security confinement.

For SELinux systems, check audit logs:

bash
sudo ausearch -m avc -ts recent | grep docker
8Check CPU architecture compatibility

If running an image built for a different architecture, you'll get "exec format error":

bash
# Check your system architecture
uname -m

# Check image architecture
docker inspect --format='{{.Architecture}}' your-image

Solutions:
- Pull the correct architecture: docker pull --platform linux/amd64 your-image
- Use multi-arch builds
- Enable QEMU emulation: docker run --privileged --rm tonistiigi/binfmt --install all

Advanced notes

### MountFlags Systemd Issue

On some Linux distributions, the Docker systemd service includes MountFlags=slave which can cause mount-related OCI errors:

bash
# Check if this is the issue
sudo grep MountFlags /etc/systemd/system/docker.service

# Remove the line and reload
sudo sed -i '/MountFlags/d' /etc/systemd/system/docker.service
sudo systemctl daemon-reload
sudo systemctl restart docker

### WSL Configuration (Windows)

On Windows with WSL, ensure you're using WSL2:

powershell
# Check WSL version
wsl --list --verbose

# Upgrade to WSL2 if needed
wsl --set-version Ubuntu 2

### Kubernetes/EKS cgroup Issues

In Kubernetes environments (especially EKS), cgroup v2 compatibility can cause this error:

bash
error during container init: error setting cgroup config for procHooks process

Solutions:
- Update to a newer EKS AMI with kernel support for required cgroup features
- Use containerd runtime with proper cgroup driver configuration

### Debugging with strace

For complex cases, trace the runc execution:

bash
sudo strace -f -o /tmp/runc.log docker run your-image

Look for ENOENT (file not found) or EACCES (permission denied) near the end of the log.

### Scratch/Distroless Images

When using FROM scratch or distroless base images, ensure:
- Your binary is statically compiled
- No shared library dependencies (ldd your-binary should show "not a dynamic executable")
- The binary path is correct and absolute

Frequently asked questions

What does "OCI runtime create failed: container init process failed" mean?
The "OCI runtime create failed: container init process failed" error indicates that Docker's underlying container runtime (runc) was unable to start the init process inside the container. This happens during the container creation phase, before your application even begins running. OCI (Open Container Initiative) defines the standard for container runtimes.
How do I fix "OCI runtime create failed: container init process failed"?
This error occurs when the container runtime (runc) fails to initialize and start your container process. Common causes include missing executables, incorrect file permissions, invalid entrypoints, or Docker version incompatibilities.
What causes "OCI runtime create failed: container init process failed"?
Executable specified in ENTRYPOINT or CMD not found in the container image (most common) Shell script has incorrect line endings (CRLF instead of LF) Missing execute permissions on the entrypoint script
Is the "OCI runtime create failed: container init process failed" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading