Introducing Attribute by DoiT - Runtime, Token-Level AI Attribution.
PerfectScalePerfectScale
LoginStart for Free

PerfectScale

CreateContainerConfigError vs CreateContainerError in K8s

CreateContainerConfigError vs CreateContainerError in Kubernetes: what causes each, how to troubleshoot with kubectl, and how to fix them.

This page is also available in Deutsch, Español, Français, Italiano, 日本語, and Português.

Tania Duggal
By Tania DuggalMay 26, 202410 min read

TLDR: Both errors happen before your container ever starts, so there are no application logs to check, only Kubernetes events and pod descriptions. CreateContainerConfigError means Kubernetes couldn't assemble the container's configuration (usually a missing ConfigMap or Secret). CreateContainerError means the config was fine but the container runtime (containerd, Docker) failed to actually create the container (bad image, resource constraints, bad volume mounts, or a runtime problem). Fix by creating the missing ConfigMap/Secret, checking image and entrypoint, and comparing requested resources against what's available.

CreateContainerConfigError and CreateContainerError error messages play a crucial role in effective monitoring and troubleshooting. These errors provide valuable insights into container configuration issues and help ensure smooth container deployment. So, let's look at what CreateContainerConfigError and CreateContainerError mean, why they occur in Kubernetes, and how to resolve them. The primary difference between the two is when they happen during the Pod deployment lifecycle.

CreateContainerConfigError means Kubernetes cannot assemble the required configuration data, such as missing variables or configuration files, before launching the container. CreateContainerError means the configuration is ready, but the underlying container runtime engine, such as containerd or Docker, failed to physically create the container on the host node. Because both errors occur before the container starts up, no application logs are generated inside the container for either error.

Here are some of the main Kubernetes errors, and quick advice for how to troubleshoot them.

In this article:

What is CreateContainerConfigError?

CreateContainerConfigError is an error that occurs during the creation of the container because the configuration is incorrect or something is missing in the Pod's container configuration. As a result, Kubernetes is unable to produce the necessary configuration for a container.

CreateContainerConfigError flowchart: Kubernetes checks the pod's container configuration; if correct, it generates the container configuration and the container is created successfully; if not correct, Kubernetes raises a CreateContainerConfigError

CreateContainerConfigError flowchart

When starting a new container, Kubernetes relies on the generateContainerConfig method to read the container's configuration data or pod metadata. This includes startup commands, references to ConfigMaps and Secrets, and storage resource definitions. Under normal conditions, Kubernetes locates these resources defined in the configuration and connects the container to them. If Kubernetes cannot find these resources, it triggers a CreateContainerConfigError event.

General Causes of CreateContainerConfigError in Kubernetes

CreateContainerConfigError often occurs when Kubernetes cannot find resources essential for a container's configuration, typically ConfigMaps or secrets.

Missing ConfigMaps

A ConfigMap is an API object used to store configuration data that can be accessed by containers running within pods. It provides a way to decouple configuration details from container images, allowing for more flexibility and easier management of configuration settings.

Let's look at how you define a ConfigMap and then reference it in a Pod configuration.

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-configmap
data:
  config.json: |
    {
        "key": "value"
    }

Pod's Configuration Referencing the ConfigMap:

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: <image-name>
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
  volumes:
  - name: config-volume
    configMap:
      name: my-configmap

When creating a Pod, you have to reference the ConfigMap in your Pod's configuration. If that ConfigMap exists, the Pod can access it. But if not, you'll encounter the CreateContainerConfigError.

Missing Secrets

Secrets in Kubernetes are a way to securely store sensitive information that is used by applications running in a cluster.

Now, let's consider an example where a Pod is configured to use a Secret for storing sensitive information.

apiVersion: v1
kind: Secret
metadata:
  name: my-secret
type: Opaque
data:
  password: cGFzc3dvcmQ=  # Base64 encoded value of 'password'

Pod's Configuration Referencing the Secret:

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: <image-name>
    env:
    - name: DATABASE_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-secret
          key: password

The same error you get if you configure a container to use secrets that don't exist.

So make sure to set up the ConfigMaps and secrets before launching the pod and referencing them in Pod's configuration.

Troubleshooting CreateContainerConfigError

To troubleshoot CreateContainerConfigError, start first looking at relevant logs and events to confirm it is an error due to a configuration mistake or missing something.

There are some steps that you can follow to troubleshoot the error:

  1. View Pod and logs: Use the kubectl logs command to check the logs of the affected Pod. Look for log messages indicating a CreateContainerConfigError.
   ~ kubectl get pods
     NAME    READY    STATUS                       RESTARTS     AGE
     my-pod   0/2     CreateContainerConfigError   1 (10s ago)  28s
  1. Check Kubectl Events: Run the kubectl get events command to identify any events related to CreateContainerConfigError. Look for events specifically mentioning this error.
   ~ kubectl get events
  1. Inspect Pods deeply: Use the kubectl describe pod pod-name command to inspect the Pod's configuration. You can see here any missing or misconfigured resources.
   ~ kubectl describe pod my-pod
     Warning  Failed   56s (x6 over 1m45s)
     kubelet   Error: configmap "my-configmap" not found
  1. Verify Permissions and Namespace Settings: If all the resources are properly configured but still encounter CreateContainerConfigError, check the permissions and namespace settings. Ensure that the resources are accessible to the pod and are in the same namespace.

Fixing CreateContainerConfigError

To resolve CreateContainerConfigError, follow these best practices:

  1. Create Missing ConfigMaps and Secrets: If a referenced ConfigMap or Secret is missing, create it using the appropriate kubectl create command. Ensure that the resource is created in the same namespace as the pod.
   ~ kubectl create configmap my-configmap
     kubectl create secret generic my-secret

  1. Configure Permissions Properly: Verify that the permissions for the resources are correctly set, allowing the pod to access them. Adjust the permissions if necessary.

  2. Double-check Resource Configuration: Review the pod's configuration and ensure that all references to ConfigMaps and Secrets are accurate and properly spelled. Avoid typos that may cause the pod to look for resources in the wrong place.

What is CreateContainerError?

CreateContainerError is an error that occurs when Kubernetes fails to create a container within a pod. It indicates failure in the containerization process. It means the issue is related to the container's creation itself.

Kubernetes Container Creation Error sequence diagram: the Client requests container creation from the Kubernetes API, which asks the Container Runtime to initialize the container; the Container Runtime fails to create the container, and the Kubernetes API returns a CreateContainerError to the Client.

CreateContainerError

General Causes of CreateContainerError in Kubernetes

The following problems are typically responsible for causing CreateContainerError events:

  1. Image Issues: One of the common causes is an issue with the container image. It could be an invalid or non-existent image, missing a default entrypoint, and no manual entrypoint specified in the application configuration.

  2. Resource Constraints: Insufficient resources, such as CPU or memory, can lead to a CreateContainerError. If the requested resources exceed the available capacity, the container creation process fails.

  3. Incorrect Volume Mounts: If the container's volume mounts are misconfigured or reference non-existent storage resources, the container creation process can fail. This can happen if the specified storage volumes or persistent volume claims (PVCs) do not exist or are not accessible.

  4. Container Runtime Problems: Container runtimes are responsible for managing and executing containers within a Kubernetes cluster. If the container runtime is buggy or lacks sufficient resources to operate normally, it can result in unexpected behavior and errors like CreateContainerError.

Troubleshooting CreateContainerError

The steps for troubleshooting are quite similar to CreateContainerConfigError; let's have a look:

  1. Check Pod Status and logs: By kubectl get pods command, view the status of available Pods and if your Pod failed due to CreateContainerError, you'll see the CreateContainerError in the STATUS field of output.

  2. Inspect Pods deeply: Use kubectl describe pod pod-name to inspect the pod and you can see here detailed information about a specific Pod.

  3. Check Kubectl Events: Run the kubectl get events command to identify any events related to CreateContainerError. Look for events specifically mentioning this error.

  4. Check Pod's Manifests: See if your Pod's configuration is correctly configured, make sure your Pod can access the volume if you reference it in the configuration, and additionally, verify that the container's image is valid and includes a properly defined entrypoint.

Fixing CreateContainerError

Fixing CreateContainerError depends upon the cause of the problem:

  1. Missing Entrypoint: You can fix this issue by selecting the right image or by defining the manual entrypoint in the application configuration.

  2. Storage Problems: Make sure your Pod can access the volumes you've configured and Pod's configuration properly references them.

  3. Container Runtime Problem: The container runtime is up to date and compatible with the underlying system components. Additionally, allocating sufficient resources to the container runtime and monitoring its performance can help prevent runtime-related errors. Regular maintenance, updates, and troubleshooting can help resolve container runtime problems and ensure smooth container operations in Kubernetes.

Navigating through CreateContainerConfigError and CreateContainerError in Kubernetes can be challenging, but understanding their causes and knowing how to troubleshoot these issues effectively can significantly enhance your container management and deployment processes. By following these outlined steps and best practices, you can mitigate these errors, ensuring a more stable and efficient Kubernetes environment.

Troubleshoot Kubernetes Errors 10x Faster with PerfectScale by DoiT

PerfectScale Kubernetes governance platform continuously monitors workload behavior and detects signs of instability, such as OOM events or CPU throttling, that often lead to crash loops.

Identify up to 30 Different Resilience Types of Risks

PerfectScale's tracks up to 30 K8s alerts are tailored specifically for Kubernetes. They cover a wide range of potential issues, such as pod failures or resource exhaustion, eliminating the need for deep Kubernetes expertise.

Identify up to 30 different Resilience types of risks with PerfectScale

Real-time Alerts without Alerts Fatigue

PerfectScale allows users to easily set up alerts for their clusters and manage them efficiently with Alert Profiles. You can easily monitor and get notified about alerts that are relevant for your setup.

For faster updates, utilize Slack or MS Teams Integration Profiles to receive notifications when an Alert is generated.

Get Actionable Recommendations to Eliminate Kubernetes CreateContainerConfigErrors

By leveraging real usage data and resilience-aware policies, PerfectScale delivers precise recommendations for right-sizing workloads at the container level, ensuring workloads have exactly what they need. Whether applied manually or autonomously for immediate impact, these recommendations restore workload stability, eliminate recurring restarts, and help prevent similar failures in the future.

To apply the recommendations, you can effortlessly copy the .yaml and deploy it to your cluster.

Get actionable recommendations to eliminate Kubernetes CreateContainerConfigErrors

Join industry leaders like Paramount Pictures and Creditas who have already optimized their Kubernetes environments with PerfectScale. Sign up or book a demo with our technical experts now!

FAQ

What's the difference between CreateContainerConfigError and CreateContainerError? CreateContainerConfigError happens earlier: Kubernetes can't assemble the container's configuration, usually because a referenced ConfigMap or Secret is missing. CreateContainerError happens after the config is ready, when the container runtime itself fails to create the container (bad image, resource limits, bad volume mounts, or a runtime issue).

Why are there no application logs for these errors? Both errors occur before the container actually starts, so the application inside it never runs and never produces logs. You have to rely on kubectl describe pod and kubectl get events instead.

How do I fix a CreateContainerConfigError caused by a missing ConfigMap or Secret? Create the missing resource in the same namespace as the pod, for example kubectl create configmap my-configmap or kubectl create secret generic my-secret, then double-check the pod spec references the correct name and namespace.

What typically causes CreateContainerError? Most often an invalid or missing container image, no entrypoint defined, insufficient CPU/memory to satisfy the pod's resource requests, misconfigured volume mounts, or a problem with the container runtime itself (containerd, Docker).

What's the first command to run when I see either error? kubectl get pods to confirm the error in the STATUS column, then kubectl describe pod <pod-name> to see the specific event message (e.g. "configmap not found"), then kubectl get events for additional context.

Can PerfectScale help prevent these errors? Yes. PerfectScale monitors workload behavior for signs of instability (like OOM events or CPU throttling) and delivers right-sizing recommendations at the container level, aiming to catch and prevent resource-related config and runtime failures before they recur.