How to fix ContainerCreating in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 484 views

Pods stuck in ContainerCreating cannot start containers due to image pull issues, volume mount failures, or CNI network problems. Check events for the specific cause.

Quick fix

Fixes ContainerCreating

kubectl describe pod <pod-name>
  1. Check pod events for specific errors
  2. Diagnose image pull issues
  3. Check volume and PVC status
  4. Diagnose network/CNI issues
kubernetes — error
kubectl describe pod <pod-name>
ContainerCreating

What this error means

A pod stuck in ContainerCreating status means Kubernetes is trying to set up the container environment but cannot complete the process. This phase includes pulling images, mounting volumes, and configuring the container network. Unlike CrashLoopBackOff (where containers start then fail), ContainerCreating indicates the container hasn't started at all. The issue is in the infrastructure or configuration required to create the container sandbox.

Typical symptoms

  • Pod status shows ContainerCreating for extended periods
  • kubectl describe pod shows events but no container start
  • Deployment rollout stalls waiting for containers to create
  • No application logs available since container never started
  • Events may show timeout or waiting messages
  • Multiple pods on same node stuck in same state

Common causes

  1. Container image pull taking too long or failing
  2. PersistentVolumeClaim not bound to a PersistentVolume
  3. Volume mount timeout or failure (NFS, cloud storage)
  4. CNI plugin cannot assign pod IP address
  5. Missing ConfigMap or Secret referenced by the pod
  6. Container runtime (containerd/docker) issues
  7. Node running out of resources or disk space
  8. Network CIDR exhaustion in cloud environments

How to fix "ContainerCreating"

1Check pod events for specific errors

Get detailed information about what's blocking container creation:

bash
kubectl describe pod <pod-name>

Look at the Events section for messages like:
- "pulling image" - Image download in progress or stuck
- "FailedMount" - Volume mount issue
- "FailedCreatePodSandBox" - Network/CNI problem
- "configmap not found" - Missing ConfigMap

Events appear in chronological order; recent events show current blockers.

2Diagnose image pull issues

If events show image pull problems:

bash
# Check if image exists and is accessible
docker pull <image>:<tag>

# Verify image pull secrets exist
kubectl get secrets | grep -i registry
kubectl get pod <pod-name> -o yaml | grep imagePullSecrets

For large images, pulling can take several minutes. Check the node's container runtime:

bash
# On the node
crictl images
crictl pull <image>
3Check volume and PVC status

Volume issues are common causes of stuck ContainerCreating:

bash
# Check PVC status
kubectl get pvc

# If PVC is Pending, check why
kubectl describe pvc <pvc-name>

# Check PV availability
kubectl get pv

Common fixes:
- Create a PersistentVolume matching the PVC
- Install the required CSI driver
- Fix storage class configuration

4Diagnose network/CNI issues

If events show sandbox or network errors:

bash
# Check CNI plugin status
kubectl get pods -n kube-system | grep -E "calico|flannel|weave|cilium"

# Check node network
kubectl describe node <node-name> | grep -A 10 Conditions

On the node:

bash
# Check CNI configuration
ls /etc/cni/net.d/
cat /etc/cni/net.d/*.conf

# Restart CNI pods if needed
kubectl rollout restart daemonset <cni-daemonset> -n kube-system
5Verify ConfigMaps and Secrets exist

Missing configuration resources block container creation:

bash
# List ConfigMaps and Secrets in namespace
kubectl get configmaps
kubectl get secrets

# Check what the pod expects
kubectl get pod <pod-name> -o yaml | grep -A 5 configMapRef
kubectl get pod <pod-name> -o yaml | grep -A 5 secretRef

Create missing resources before the pod can start.

6Check node and runtime health

Node-level issues can block all pods:

bash
# Check node conditions
kubectl describe node <node-name>

# Check disk space on node
ssh <node-ip> df -h

# Check container runtime
ssh <node-ip> systemctl status containerd
ssh <node-ip> journalctl -u containerd -n 50

If the container runtime is unhealthy, restart it:

bash
sudo systemctl restart containerd

Advanced notes

On AWS EKS, ContainerCreating often indicates IP address exhaustion. Each pod requires an IP from the VPC subnet. Check available IPs:

bash
aws ec2 describe-subnets --subnet-ids <subnet-id> --query 'Subnets[].AvailableIpAddressCount'

Solutions include using smaller instance types (fewer IPs per node), enabling prefix delegation, or adding subnets.

For GKE and AKS, similar IP exhaustion can occur with VPC-native clusters. Consider expanding the pod CIDR range.

Image pull timeouts on large images (>1GB) may require adjusting kubelet's image-pull-progress-deadline. For air-gapped environments, pre-pull images to nodes or use a local registry mirror.

Frequently asked questions

What does "ContainerCreating" mean?
A pod stuck in ContainerCreating status means Kubernetes is trying to set up the container environment but cannot complete the process. This phase includes pulling images, mounting volumes, and configuring the container network. Unlike CrashLoopBackOff (where containers start then fail), ContainerCreating indicates the container hasn't started at all.
How do I fix "ContainerCreating"?
Pods stuck in ContainerCreating cannot start containers due to image pull issues, volume mount failures, or CNI network problems. Check events for the specific cause.
What causes "ContainerCreating"?
Container image pull taking too long or failing PersistentVolumeClaim not bound to a PersistentVolume Volume mount timeout or failure (NFS, cloud storage)
Is the "ContainerCreating" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading