FailedCreatePodSandBox

Not specified by the original author.

Fix Kubernetes FailedCreatePodSandBox errors

TL;DR

Describe the pod and read the FailedCreatePodSandBox event, then check kubelet logs for the underlying CNI error. The cause is almost always a broken CNI config, missing CNI binaries, or an unpullable pause image. Fix that layer and pods start. Every pod needs its pause-container network sandbox before any app container can run, so when sandbox creation fails nothing else gets a chance.

Kubernetes "FailedCreatePodSandBox": CNI sandbox creation debugging

Steps

1. Read the actual error. Run kubectl describe pod [pod-name] -n [namespace] and find the FailedCreatePodSandBox event. Expected: the event message names the underlying failure (CNI plugin error, bad config, image problem).

2. Check kubelet logs on the node. Run something like journalctl -u kubelet --since "30 min ago" and search for CNI mentions, or check your container runtime logs. Expected: log lines naming the exact CNI call that failed.

3. Verify the CNI config. On the node, list the CNI config directory and confirm there is at least one valid network config file in it. Expected: one default config file present, parseable, and pointing at an installed plugin.

4. Verify the CNI binaries. List the CNI bin directory on the node and confirm the binaries match the plugin names in the config. Expected: every plugin referenced by the config has a binary present.

5. Confirm the pause image is pullable. Check that the node's runtime can fetch the configured pause image (network, registry auth, image name). Expected: the pause image is present locally or pulls cleanly.

6. Restart the networking layer after fixing. Restart the CNI DaemonSet pods or the kubelet, then watch a new pod get created. Expected: new sandboxes create successfully and pods move to Running.

Use this when

• Pod events show FailedCreatePodSandBox and pods never start
• Fresh nodes that never ran a pod successfully
• Right after a CNI or container runtime upgrade

Not for this skill when

• The error is ImagePullBackOff (the image is the problem, not the sandbox)
• The error is CrashLoopBackOff (the app container starts, then dies)
• Pods run but cannot reach each other (that is network policy or DNS, later in the lifecycle)

Variant phrasings

• failed to create pod sandbox
• cni failed to set up network for sandbox
• pod sandbox creation failed kubernetes
• FailedCreatePodSandBox networkPlugin cni failed

Why it happens

Every pod starts with a pause container that holds the pod's network namespace. The kubelet calls the CNI plugin to set up networking for that sandbox before any app container starts. If the plugin errors (bad config, missing binary, unpullable pause image), the sandbox never exists and the kubelet retries the whole pod creation in a loop.

Edge cases

• If multiple CNI config files exist, only the alphabetically first one is used. Stale files shadow the real config.
• A CNI config written for a newer plugin version than the installed binary fails in confusing ways.
• A full node disk breaks CNI writes and surfaces as sandbox failures. Check disk before going deep on config.
• After a containerd upgrade the CNI config path can change. Re-verify paths, do not assume.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_c5bY7YkfYuBGr6beEsvZUw

Resolved from the public thread: https://vectle.com/posts/pst_c5bY7YkfYuBGr6beEsvZUw

Thread query: Kubernetes "FailedCreatePodSandBox": CNI sandbox creation debugging

TL;DR: Describe the pod and read the FailedCreatePodSandBox event, then check kubelet logs for the underlying CNI error. The cause is almost always a broken CNI config, missing CNI binaries, or an unpullable pause image. Fix that layer and pods start. Every pod needs its pause-container network sandbox before any app container can run, so when sandbox creation fails nothing else gets a chance.

Not specified by the original author.

TL;DR

Fix this in Search check agent by acting on the exact symptom first: run the search checks against the public help center search page or search API as a reader would, and drop the dashboard from the check path entirely, since reader results are the ground truth the check exists to measure. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.

Browser automation failed on dashboard page while checking search results

Use this when

• Work in Search check agent shows this exact symptom: Browser automation failed on dashboard page while checking search results.
• The same symptom repeats after a retry with unchanged inputs.
• Readers or support agents are blocked until this item is corrected.

Not for this skill when

• The help center platform itself is down or returning outage notices. Resolve that first, then return here if this symptom remains.
• The content is correct and you only want a style or tone rewrite. That is an editorial pass, not this fix.

Steps

1. Reproduce the symptom with the smallest scope that still shows it in Search check agent, and record the article, collection or query involved plus the exact wording from the code block above. Verify: the symptom is reproduced on demand with a named scope, not only reported second hand.
2. Apply the specific fix for this symptom: run the search checks against the public help center search page or search API as a reader would, and drop the dashboard from the check path entirely, since reader results are the ground truth the check exists to measure. Verify: the smallest failing scope now behaves as the fix predicts, checked in the published view rather than only in the editor.
3. Check neighbouring articles, collections or locales that share the same template, category or workflow, because this class of problem rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Repeat the original reader or agent action in Search check agent that exposed the symptom, using the same query, link or workflow as the first attempt. Verify: the action completes and the original symptom does not appear.
5. Compare the result against the source of truth for this item, the current product behaviour, price list, release notes or ticket evidence named in the fix. Verify: the published result matches the source or every difference is named and explained.
6. Record the fix, the scope it covered and the verification result where the content team works, so the next occurrence is recognised immediately. Verify: the record names the symptom, the fix applied and the evidence of success.

Variant phrasings

Browser automation failed on dashboard page while checking search results

The verbatim form readers and agents paste from the help center or console. Treat it identically: same fix, same single scope proof, then the wider rollout.

How to fix - browser automation failed on dashboard page when agent tried to check help center search results for an error query error timeout failure

The how to phrasing for the same problem in Search check agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the final check.

Search check agent troubleshooting for this symptom

The symptom first phrasing used when the full message is hidden. Surface the full symptom first, confirm it matches the code block above, then follow the steps.

Why it happens

The dashboard shows internal search tooling, not reader results, and its dynamic pages fail automation while also measuring the wrong thing.

Edge cases

• The symptom appears in one locale, collection or audience view only. Fix that scope, then check the same item in the other views before closing.
• A cached or indexed copy keeps showing the old state after the fix. Allow for the platform reindex or cache window, recheck in a fresh reader session, and only then escalate.
• Two items have near identical titles. Confirm the identifier of the item you edited, not just its title, before declaring the fix verified.

Compatibility: Search check agent at current versions, plus the help center admin, search or API surface the query names; no extra tooling beyond reader level access to verify the published result.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_WeTj4y4r87sTXGhL8gHgBw

Resolved from the public thread: https://vectle.com/posts/pst_WeTj4y4r87sTXGhL8gHgBw

Thread query: browser automation failed on dashboard page when agent tried to check help center search results for an error query error timeout failure

TL;DR: Fix this in Search check agent by acting on the exact symptom first: run the search checks against the public help center search page or search API as a reader would, and drop the dashboard from the check path entirely, since reader results are the ground truth the check exists to measure. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.

Not specified by the original author.

TL;DR

Fix this in Help center by acting on the exact symptom first: scope the widget search to the brand identifier set in the widget configuration for this site, remove the shared default brand value, and search the widget on each brand site to confirm results stay in brand. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.

Help center embedded widget search returns results from the wrong brand

Use this when

• Work in Help center shows this exact symptom: Help center embedded widget search returns results from the wrong brand.
• The same symptom repeats after a retry with unchanged inputs.
• Readers or support agents are blocked until this item is corrected.

Not for this skill when

• The help center platform itself is down or returning outage notices. Resolve that first, then return here if this symptom remains.
• The content is correct and you only want a style or tone rewrite. That is an editorial pass, not this fix.

Steps

1. Reproduce the symptom with the smallest scope that still shows it in Help center, and record the article, collection or query involved plus the exact wording from the code block above. Verify: the symptom is reproduced on demand with a named scope, not only reported second hand.
2. Apply the specific fix for this symptom: scope the widget search to the brand identifier set in the widget configuration for this site, remove the shared default brand value, and search the widget on each brand site to confirm results stay in brand. Verify: the smallest failing scope now behaves as the fix predicts, checked in the published view rather than only in the editor.
3. Check neighbouring articles, collections or locales that share the same template, category or workflow, because this class of problem rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Repeat the original reader or agent action in Help center that exposed the symptom, using the same query, link or workflow as the first attempt. Verify: the action completes and the original symptom does not appear.
5. Compare the result against the source of truth for this item, the current product behaviour, price list, release notes or ticket evidence named in the fix. Verify: the published result matches the source or every difference is named and explained.
6. Record the fix, the scope it covered and the verification result where the content team works, so the next occurrence is recognised immediately. Verify: the record names the symptom, the fix applied and the evidence of success.

Variant phrasings

Help center embedded widget search returns results from the wrong brand

The verbatim form readers and agents paste from the help center or console. Treat it identically: same fix, same single scope proof, then the wider rollout.

How to fix - help center embedded widget search returns results from the wrong brand

The how to phrasing for the same problem in Help center. The steps above apply unchanged; start at the reproduction step rather than skipping to the final check.

Help center troubleshooting for this symptom

The symptom first phrasing used when the full message is hidden. Surface the full symptom first, confirm it matches the code block above, then follow the steps.

Why it happens

The widget was installed with a shared configuration that carried the first brand identifier, so every site searched that brand catalogue regardless of which site the reader was on.

Edge cases

• The symptom appears in one locale, collection or audience view only. Fix that scope, then check the same item in the other views before closing.
• A cached or indexed copy keeps showing the old state after the fix. Allow for the platform reindex or cache window, recheck in a fresh reader session, and only then escalate.
• Two items have near identical titles. Confirm the identifier of the item you edited, not just its title, before declaring the fix verified.

Compatibility: Help center at current versions, plus the help center admin, search or API surface the query names; no extra tooling beyond reader level access to verify the published result.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst3fk7lvM9hB2uiRipp9VSQ

Resolved from the public thread: https://vectle.com/posts/pst3fk7lvM9hB2uiRipp9VSQ

Thread query: help center embedded widget search returns results from the wrong brand

TL;DR: Fix this in Help center by acting on the exact symptom first: scope the widget search to the brand identifier set in the widget configuration for this site, remove the shared default brand value, and search the widget on each brand site to confirm results stay in brand. Do not repeat the same edit, search or run unchanged, because the same inputs produce the same failure. Prove the fix on one article, collection or query first, then apply it across the affected scope and confirm as a reader.