How to fix Error response from daemon: OCI runtime create failed: kata runtime error in Docker

# Check if kata-runtime binary exists
which kata-runtime

# Verify kata-runtime version
kata-runtime --version

# Run Kata's built-in system compatibility check
kata-runtime kata-check

# Add the Kata Containers repository
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.opensuse.org/repositories/home:/katacontainers:/releases:/x86_64:/master/xUbuntu_22.04/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kata-containers.gpg

echo "deb [signed-by=/etc/apt/keyrings/kata-containers.gpg] https://download.opensuse.org/repositories/home:/katacontainers:/releases:/x86_64:/master/xUbuntu_22.04/ /" | sudo tee /etc/apt/sources.list.d/kata-containers.list

sudo apt update
sudo apt install -y kata-runtime kata-containers-image

# Download and run kata-manager
bash -c "$(curl -fsSL https://raw.githubusercontent.com/kata-containers/kata-containers/main/utils/kata-manager.sh)"

# Check for CPU virtualization support
cat /proc/cpuinfo | grep -E "(vmx|svm)"

# Run kata-check for comprehensive verification
sudo kata-runtime kata-check

# Enable nested virtualization on the host
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel nested=1

# Edit Docker daemon configuration
sudo nano /etc/docker/daemon.json

{
  "runtimes": {
    "kata": {
      "path": "/usr/bin/kata-runtime"
    },
    "kata-qemu": {
      "path": "/usr/bin/containerd-shim-kata-qemu-v2"
    },
    "kata-fc": {
      "path": "/usr/bin/containerd-shim-kata-fc-v2"
    }
  }
}

sudo systemctl daemon-reload
sudo systemctl restart docker

docker info | grep -i runtime

# Check for guest kernel
ls -la /usr/share/kata-containers/

# You should see files like:
# - vmlinuz.container (guest kernel)
# - kata-containers.img or kata-containers-initrd.img (root filesystem)
# - OVMF.fd or similar (UEFI firmware, if using UEFI boot)

# Using kata-manager
kata-manager install-packages

# Or manually install missing packages (Ubuntu)
sudo apt install kata-runtime kata-containers-image kata-linux-container kata-proxy kata-shim

# For QEMU
which qemu-system-x86_64

# For Firecracker
which firecracker

# Edit containerd config
sudo nano /etc/containerd/config.toml

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
  runtime_type = "io.containerd.kata.v2"
  privileged_without_host_devices = true
  pod_annotations = ["io.katacontainers.*"]

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
  runtime_type = "io.containerd.kata-qemu.v2"
  privileged_without_host_devices = true

sudo systemctl restart containerd

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata
handler: kata

spec:
  runtimeClassName: kata

docker run --rm --runtime=kata alpine uname -r

sudo ctr image pull docker.io/library/alpine:latest
sudo ctr run --runtime "io.containerd.kata.v2" --rm -t docker.io/library/alpine:latest test-kata uname -r

nerdctl run --runtime kata --rm alpine uname -r

# Docker daemon logs
sudo journalctl -u docker.service -n 100 --no-pager

# Containerd logs
sudo journalctl -u containerd.service -n 100 --no-pager

# Check SELinux status
getenforce

# Check for Kata-related denials
sudo ausearch -m avc -ts recent | grep kata

# Temporarily set permissive (for testing only)
sudo setenforce 0

# Check AppArmor status
sudo aa-status

# Check for Kata denials
sudo dmesg | grep -i apparmor | tail -20

# Test with AppArmor disabled for the container
docker run --security-opt apparmor=unconfined --runtime=kata alpine uname -r

# Check versions
kata-runtime --version
docker --version
containerd --version

# Using kata-manager
kata-manager install-packages --force

# Or using package manager
sudo apt update && sudo apt upgrade kata-runtime

# Check available versions
apt-cache madison kata-runtime