How to fix CreateContainerError in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 206 views

CreateContainerError occurs when the container runtime fails to create the container. Unlike config errors, this indicates runtime failures like duplicate containers, volume issues, or permission problems.

Quick fix

Fixes CreateContainerError

kubectl describe pod <pod-name>
  1. Check pod events for specific error
  2. Check for duplicate container names
  3. Verify container has a valid entrypoint
  4. Check volume mount accessibility
kubernetes — error
kubectl describe pod <pod-name>
CreateContainerError

What this error means

CreateContainerError occurs when Kubernetes validates the pod manifest successfully but the container runtime (containerd, Docker) fails to actually create the container. This is different from CreateContainerConfigError, which happens earlier when the configuration itself is invalid. The distinction is important: CreateContainerConfigError means the pod spec references missing resources (ConfigMaps, Secrets). CreateContainerError means the spec is valid but something prevents the runtime from creating the container—like volume access issues, duplicate container names, or missing entrypoints.

Typical symptoms

  • Pod status shows CreateContainerError
  • Container never starts - stays in error state without restarts
  • Events show failed to create container messages
  • Issue may affect multiple pods if it is node-level
  • No application logs available since container never ran
  • Kubelet logs show runtime-specific error details

Common causes

  1. Duplicate container name exists from previous failed cleanup
  2. Container image has no entrypoint and pod spec has no command
  3. Volume mount path inaccessible or permission denied
  4. Container runtime (containerd/docker) malfunction
  5. Node resource exhaustion preventing container creation
  6. Working directory specified does not exist in image
  7. Security context prevents container operations

How to fix "CreateContainerError"

1Check pod events for specific error

Get details about the failure:

bash
kubectl describe pod <pod-name>

Look for Events showing:
- "failed to create container"
- Specific error messages from the runtime
- Volume mount failures
- Permission denied errors

The error message usually indicates the exact problem.

2Check for duplicate container names

Old containers may not have been cleaned up:

bash
# On the node, list all containers
crictl ps -a | grep <pod-name>

# Or with docker
docker ps -a | grep <pod-name>

Remove orphaned containers:

bash
crictl rm <container-id>
# or
docker rm <container-id>

This often happens after node issues or runtime crashes.

3Verify container has a valid entrypoint

If the image has no ENTRYPOINT/CMD and the pod spec has no command:

bash
# Check image configuration
docker inspect <image> | grep -A 10 "Cmd\|Entrypoint"

Add a command to your pod spec:

yaml
spec:
  containers:
  - name: app
    image: myimage
    command: ["/app/start.sh"]
    # or
    args: ["--config", "/etc/config"]
4Check volume mount accessibility

Volume issues can prevent container creation:

bash
# Check PV/PVC status
kubectl get pv,pvc

# Verify mount points on node
ssh <node-ip>
ls -la /var/lib/kubelet/pods/*/volumes/

Common issues:
- PV not bound to PVC
- NFS share inaccessible
- Host path doesn't exist
- SELinux blocking mount

5Restart the container runtime

If the runtime is malfunctioning:

bash
# On the affected node
ssh <node-ip>

# For containerd
sudo systemctl restart containerd

# For docker (older clusters)
sudo systemctl restart docker

# Check status
sudo systemctl status containerd

This cleans up orphaned resources and resets runtime state.

6Check kubelet logs for details

Kubelet logs contain detailed runtime errors:

bash
# On the node
journalctl -u kubelet -n 100 | grep -i error

# Or search for the specific pod
journalctl -u kubelet | grep <pod-name>

Look for:
- Permission denied errors
- Missing directory/file errors
- Runtime communication failures

These logs often reveal the root cause that pod events summarize.

Advanced notes

CreateContainerError can cascade across a node if the container runtime is unhealthy. If multiple pods on the same node show this error, focus on node-level debugging rather than individual pods.

For SELinux-enabled systems, container creation can fail with "permission denied" even when file permissions look correct. Check SELinux denials:

bash
ausearch -m avc -ts recent

Working directory issues occur when the pod spec sets workingDir to a path that doesn't exist in the container image. Either remove the workingDir setting or ensure the directory exists in the image.

In rare cases, CreateContainerError results from kernel-level issues like cgroup configuration problems or resource controller failures. Check dmesg on the node for system-level errors.

Frequently asked questions

What does "CreateContainerError" mean?
CreateContainerError occurs when Kubernetes validates the pod manifest successfully but the container runtime (containerd, Docker) fails to actually create the container. This is different from CreateContainerConfigError, which happens earlier when the configuration itself is invalid. The distinction is important: CreateContainerConfigError means the pod spec references missing resources (ConfigMaps, Secrets).
How do I fix "CreateContainerError"?
CreateContainerError occurs when the container runtime fails to create the container. Unlike config errors, this indicates runtime failures like duplicate containers, volume issues, or permission problems.
What causes "CreateContainerError"?
Duplicate container name exists from previous failed cleanup Container image has no entrypoint and pod spec has no command Volume mount path inaccessible or permission denied
Is the "CreateContainerError" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading