How to fix Error response from daemon: OCI runtime create failed: kata runtime error in Docker

What this error means

The "OCI runtime create failed: kata runtime error" indicates that Docker attempted to create a container using Kata Containers as the OCI runtime but failed during the container creation process. Kata Containers is an open-source project that provides lightweight virtual machines to run containers with stronger isolation than traditional container runtimes like runc. Unlike standard container runtimes that share the host kernel, Kata Containers launches each container inside its own micro-VM with a dedicated kernel. This requires hardware virtualization support (Intel VT-x/AMD-V) and properly configured virtualization components. The error typically surfaces when the Kata runtime is specified but the system lacks the necessary prerequisites. Common scenarios include: the Kata runtime binaries are not installed or not found in the expected path, the Docker daemon configuration references Kata incorrectly, the host system doesn't support nested virtualization (when running inside a VM), or required Kata components like the hypervisor (QEMU/Firecracker) or guest kernel are missing.

Typical symptoms

• Container fails to start when using --runtime=kata or --runtime=kata-runtime
• Error message includes 'OCI runtime create failed' and mentions kata
• Docker run or docker-compose up exits immediately with no container logs
• Container works with default runtime (runc) but fails with Kata
• Kubernetes pods stuck in ContainerCreating state when using Kata RuntimeClass
• CI/CD pipelines fail when attempting to use Kata for enhanced isolation
• Error messages referencing kata-runtime, kata-fc, or kata-qemu

Common causes

1. Kata Containers runtime is not installed on the system
2. Docker daemon.json has incorrect Kata runtime path configuration
3. Hardware virtualization (VT-x/AMD-V) is not enabled in BIOS/UEFI
4. Running inside a VM without nested virtualization support
5. Required Kata components are missing (guest kernel, hypervisor, firmware)
6. Containerd configuration doesn't include Kata runtime handlers
7. SELinux or AppArmor blocking Kata runtime operations
8. Kata runtime version incompatible with Docker/containerd version
9. Incorrect containerd runtime shim path for Kata v2 API

How to fix "Error response from daemon: OCI runtime create failed: kata runtime error"

# Check if kata-runtime binary exists
which kata-runtime

# Verify kata-runtime version
kata-runtime --version

# Run Kata's built-in system compatibility check
kata-runtime kata-check

# Add the Kata Containers repository
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.opensuse.org/repositories/home:/katacontainers:/releases:/x86_64:/master/xUbuntu_22.04/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kata-containers.gpg

echo "deb [signed-by=/etc/apt/keyrings/kata-containers.gpg] https://download.opensuse.org/repositories/home:/katacontainers:/releases:/x86_64:/master/xUbuntu_22.04/ /" | sudo tee /etc/apt/sources.list.d/kata-containers.list

sudo apt update
sudo apt install -y kata-runtime kata-containers-image

# Download and run kata-manager
bash -c "$(curl -fsSL https://raw.githubusercontent.com/kata-containers/kata-containers/main/utils/kata-manager.sh)"

# Check for CPU virtualization support
cat /proc/cpuinfo | grep -E "(vmx|svm)"

# Run kata-check for comprehensive verification
sudo kata-runtime kata-check

# Enable nested virtualization on the host
sudo modprobe -r kvm_intel
sudo modprobe kvm_intel nested=1

# Edit Docker daemon configuration
sudo nano /etc/docker/daemon.json

{
  "runtimes": {
    "kata": {
      "path": "/usr/bin/kata-runtime"
    },
    "kata-qemu": {
      "path": "/usr/bin/containerd-shim-kata-qemu-v2"
    },
    "kata-fc": {
      "path": "/usr/bin/containerd-shim-kata-fc-v2"
    }
  }
}

sudo systemctl daemon-reload
sudo systemctl restart docker

docker info | grep -i runtime

# Check for guest kernel
ls -la /usr/share/kata-containers/

# You should see files like:
# - vmlinuz.container (guest kernel)
# - kata-containers.img or kata-containers-initrd.img (root filesystem)
# - OVMF.fd or similar (UEFI firmware, if using UEFI boot)

# Using kata-manager
kata-manager install-packages

# Or manually install missing packages (Ubuntu)
sudo apt install kata-runtime kata-containers-image kata-linux-container kata-proxy kata-shim

# For QEMU
which qemu-system-x86_64

# For Firecracker
which firecracker

# Edit containerd config
sudo nano /etc/containerd/config.toml

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata]
  runtime_type = "io.containerd.kata.v2"
  privileged_without_host_devices = true
  pod_annotations = ["io.katacontainers.*"]

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.kata-qemu]
  runtime_type = "io.containerd.kata-qemu.v2"
  privileged_without_host_devices = true

sudo systemctl restart containerd

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata
handler: kata

spec:
  runtimeClassName: kata

docker run --rm --runtime=kata alpine uname -r

sudo ctr image pull docker.io/library/alpine:latest
sudo ctr run --runtime "io.containerd.kata.v2" --rm -t docker.io/library/alpine:latest test-kata uname -r

nerdctl run --runtime kata --rm alpine uname -r

# Docker daemon logs
sudo journalctl -u docker.service -n 100 --no-pager

# Containerd logs
sudo journalctl -u containerd.service -n 100 --no-pager

# Check SELinux status
getenforce

# Check for Kata-related denials
sudo ausearch -m avc -ts recent | grep kata

# Temporarily set permissive (for testing only)
sudo setenforce 0

# Check AppArmor status
sudo aa-status

# Check for Kata denials
sudo dmesg | grep -i apparmor | tail -20

# Test with AppArmor disabled for the container
docker run --security-opt apparmor=unconfined --runtime=kata alpine uname -r

# Check versions
kata-runtime --version
docker --version
containerd --version

# Using kata-manager
kata-manager install-packages --force

# Or using package manager
sudo apt update && sudo apt upgrade kata-runtime

# Check available versions
apt-cache madison kata-runtime

Advanced notes

# Use Firecracker runtime
docker run --runtime=kata-fc alpine uname -r

# Use QEMU runtime
docker run --runtime=kata-qemu alpine uname -r

# Edit Kata configuration
sudo nano /etc/kata-containers/configuration.toml

# Set enable_debug = true in [hypervisor.qemu] section
[hypervisor.qemu]
enable_debug = true

sudo journalctl -t kata

ps aux | grep -E "(qemu|firecracker)"

[hypervisor.qemu]
default_memory = 2048  # MB
default_vcpus = 1

Frequently asked questions

What does "Error response from daemon: OCI runtime create failed: kata runtime er" mean?

The "OCI runtime create failed: kata runtime error" indicates that Docker attempted to create a container using Kata Containers as the OCI runtime but failed during the container creation process. Kata Containers is an open-source project that provides lightweight virtual machines to run containers with stronger isolation than traditional container runtimes like runc. Unlike standard container runtimes that share the host kernel, Kata Containers launches each container inside its own micro-VM with a dedicated kernel.

How do I fix "Error response from daemon: OCI runtime create failed: kata runtime er"?

This error occurs when Docker cannot start a container using the Kata Containers runtime, typically due to missing Kata components, incorrect configuration, or lack of hardware virtualization support.

What causes "Error response from daemon: OCI runtime create failed: kata runtime er"?

Kata Containers runtime is not installed on the system Docker daemon.json has incorrect Kata runtime path configuration Hardware virtualization (VT-x/AMD-V) is not enabled in BIOS/UEFI

Is the "Error response from daemon: OCI runtime create failed: kata runtime er" error serious?

Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Related errors

• Error response from daemon: layer does not exist

  How to fix 'layer does not exist' in Docker

  MEDIUM

• /bin/sh: [npm,: not found

  How to fix '[command,: not found' JSON syntax error in Docker

  LOW

• Error response from daemon: image layer sha256 mismatch

  How to fix 'image layer sha256 mismatch' in Docker

  MEDIUM

• Error response from daemon: error reading log file: file size exceeds limit

  How to fix 'error reading log file: file size exceeds limit' in Docker

  MEDIUM

• WSL 2 requires an update to its kernel component

  How to fix 'WSL 2 requires an update to its kernel component' in Docker

  MEDIUM

• dial tcp: i/o timeout

  How to fix 'dial tcp: i/o timeout' in Docker

  MEDIUM

Official resources & further reading

• 📚Docker Official Documentation
• 📖
  Kata Containers Documentation(Official Docs)
• 📖
  Kata Containers with containerd Installation Guide(Official Docs)
• 📖
  Docker Engine v23.0 Release Notes - Known Kata Issues(Official Docs)
• 🐙
  Kata 2.0.0 doesn't play well with Docker - GitHub Issue(GitHub)
• 🐙
  Kata fails to start with gRPC error - GitHub Issue(GitHub)
• 🐙
  No runtime for kata-* is configured error on k3s - GitHub Issue(GitHub)
• 💬
  kata-runtime kata-check shows missing file - Stack Overflow(Stack Overflow)
• 💬
  Troubleshoot pod stuck at ContainerCreating with Kata - Stack Overflow(Stack Overflow)
• 🐙
  100 Common Docker Errors & Solutions - Dev.to(GitHub)