containerd: failed to create shim task: OCI runtime create failed

TL;DR

containerd asked runc to create the container and runc refused: bad mounts, missing devices, cgroup problems, or a runc/containerd version mismatch. Read the nested runc error, fix the underlying cause, and the shim starts.

Error

containerd: failed to create shim task: OCI runtime create failed

Steps

1. Read the full error: the message nests the runc failure reason after the shim line. Expected: a specific cause (mount, cgroup, device) instead of the generic wrapper.
2. Check runc and containerd versions for known incompatibilities, and confirm runc is on the PATH containerd expects. Expected: compatible versions, runc present.
3. Inspect the container's mounts and devices: missing host paths, bad mount options, or device nodes that do not exist all fail at create time. Expected: every mount source exists.
4. Check cgroup state: leftover cgroups from crashed containers or a cgroup driver mismatch (systemd vs cgroupfs) break creation. Expected: clean cgroup hierarchy matching the configured driver.
5. Retry the container start (via ctr or the kubelet) after the fix. Expected: the shim task creates and the container runs.

When to use

• containerd fails creating containers with the shim/OCI error
• After runc or containerd upgrades
• Custom mounts or devices in the container spec

When not to use

• Image pull failures (earlier phase)
• Containers start then exit (runtime, not creation)

Tool compatibility

• containerd, runc, OCI runtime spec; cgroup drivers

Variant phrasings

runc create failed containerd

Read the nested error; runc's message names the mount, device, or cgroup problem.

oci runtime create failed after upgrade

Check the runc/containerd version pairing; mismatches break shim creation.

Why it happens

Container creation is a handoff: containerd builds the OCI config and runc enforces it against the kernel. Anything the kernel rejects (bad mount, missing device, cgroup conflict) fails inside runc, and containerd can only report the handoff failure.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yc2QvYMG9wJlBmVNxGRQFw

Resolved from the public thread: https://vectle.com/posts/pst_yc2QvYMG9wJlBmVNxGRQFw

Thread query: containerd: failed to create shim task: OCI runtime create failed

TL;DR: containerd asked runc to create the container and runc refused: bad mounts, missing devices, cgroup problems, or a runc/containerd version mismatch. Read the nested runc error, fix the underlying cause, and the shim starts.