{"record":{"id":"06bad0e8c87fd8fc","repo":"containerd/containerd","slug":"failed-to-get-spec-w","errorCode":null,"errorMessage":"failed to get spec: %w","messagePattern":"failed to get spec: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/container_start_linux.go","lineNumber":52,"sourceCode":"\t// FIXME(fuweid):\n\t//\n\t// For builtin runc runtime, the pipe owner should be aligned with process\n\t// owner. No matter what user namespace container uses, it should work\n\t// well.\n\t//\n\t// However, gVisor runtime doesn't support runc.Options and no idea why\n\t// adding options could breaks the sig-node conformance case [when querying /stats/summary should report resource usage through the stats api].\n\t// In order to keep compatible, the change should apply to user namespace only.\n\t//\n\t// REF: https://github.com/containerd/containerd/issues/11091\n\tusernsOpts := config.GetLinux().GetSecurityContext().GetNamespaceOptions().GetUsernsOptions()\n\tif usernsOpts == nil || usernsOpts.Mode == runtime.NamespaceMode_NODE {\n\t\treturn nil, nil\n\t}\n\n\tspec, err := cntr.Spec(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get spec: %w\", err)\n\t}\n\n\tif spec.Linux == nil || spec.Process == nil {\n\t\treturn nil, fmt.Errorf(\"invalid linux platform oci runtime spec\")\n\t}\n\n\tidMap := userns.IDMap{\n\t\tUidMap: spec.Linux.UIDMappings,\n\t\tGidMap: spec.Linux.GIDMappings,\n\t}\n\thostID, err := idMap.ToHost(userns.User{\n\t\tUid: spec.Process.User.UID,\n\t\tGid: spec.Process.User.GID,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to do idmap to get host ID: %w\", err)\n\t}\n","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/container_start_linux.go#L34-L70","documentation":"updateContainerIOOwner (Linux, user-namespace support) fetches the container's OCI runtime spec via cntr.Spec(ctx) to compute uid/gid mappings for task I/O ownership. If the spec cannot be retrieved from containerd's services, the error is wrapped and returned. This only runs when a user namespace mode other than NODE is requested.","triggerScenarios":"Calling StartContainer on a container configured with user-namespace mode (e.g. POD or custom userns) while the container's spec cannot be loaded from containerd (container deleted concurrently, containerd store issue, or snapshot/content corruption).","commonSituations":"Using Kubernetes user namespaces (UserNamespaces feature) or rootless configurations; container removed between lookup and spec fetch; containerd restart mid-operation leaving stale references.","solutions":["Confirm the container still exists (`crictl inspect <id>`) and re-run the start","Check containerd logs for spec/blob store errors","If userns support is not needed, set namespace mode to NODE to bypass this path","Upgrade containerd if the spec store is known-buggy in your version"],"exampleFix":"// before: start with userns POD mode unconditionally\n// after: validate spec availability first\nstatus, _ := runtimeService.ContainerStatus(id)\nif usesUserNamespace(status) {\n    if _, err := fetchSpec(id); err != nil { // caller-side health probe\n        return fmt.Errorf(\"spec unavailable for userns container: %w\", err)\n    }\n}\nreturn runtimeService.StartContainer(id)","handlingStrategy":"try-catch","validationCode":"// only relevant when userns mode != NODE\nif usernsMode != runtime.NamespaceMode_NODE {\n    if !containerExists(id) { return fmt.Errorf(\"container %s gone\", id) }\n}","typeGuard":null,"tryCatchPattern":"err := startContainer(id)\nif errors.Is(err, ErrContainerNotFound) || errors.Is(err, grpcNotFound(err)) {\n    // container was removed concurrently: recreate\n}","preventionTips":["Avoid racing removal against start for userns containers","Keep containerd and shims up to date when using user namespaces","Use NODE namespace mode unless userns is explicitly required"],"tags":["user-namespaces","oci-spec","linux","cri"],"backgroundTag":"spec-fetch-failed","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}