{"record":{"id":"5b1045da543e4393","repo":"containerd/containerd","slug":"can-t-load-base-oci-spec-q-w","errorCode":null,"errorMessage":"can't load base OCI spec %q: %w","messagePattern":"can't load base OCI spec %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/server/container_create.go","lineNumber":519,"sourceCode":"\t\t\tHostPath:       src,\n\t\t\tSelinuxRelabel: true,\n\t\t\tUidMappings:    uidMappings,\n\t\t\tGidMappings:    gidMappings,\n\t\t})\n\t}\n\treturn mounts\n}\n\n// runtimeSpec returns a default runtime spec used in cri-containerd.\nfunc (c *criService) runtimeSpec(id string, platform imagespec.Platform, baseSpecFile string, opts ...oci.SpecOpts) (*runtimespec.Spec, error) {\n\t// GenerateSpec needs namespace.\n\tctx := util.NamespacedContext()\n\tcontainer := &containers.Container{ID: id}\n\n\tif baseSpecFile != \"\" {\n\t\tbaseSpec, err := c.LoadOCISpec(baseSpecFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can't load base OCI spec %q: %w\", baseSpecFile, err)\n\t\t}\n\n\t\tspec := oci.Spec{}\n\t\tif err := util.DeepCopy(&spec, &baseSpec); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to clone OCI spec: %w\", err)\n\t\t}\n\n\t\t// Fix up cgroups path\n\t\tapplyOpts := append([]oci.SpecOpts{oci.WithNamespacedCgroup()}, opts...)\n\n\t\tif err := oci.ApplyOpts(ctx, nil, container, &spec, applyOpts...); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to apply OCI options: %w\", err)\n\t\t}\n\n\t\treturn &spec, nil\n\t}\n\n\tspec, err := oci.GenerateSpecWithPlatform(ctx, nil, platforms.Format(platform), container, opts...)","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/server/container_create.go#L501-L537","documentation":"When a base OCI spec file is configured (base_spec_file in the CRI runtime config), runtimeSpec loads it via c.LoadOCISpec and wraps any load failure with this error. It means the base runtime spec JSON could not be read or parsed into an oci.Spec.","triggerScenarios":"baseSpecFile is set in the containerd CRI config and LoadOCISpec fails because the file does not exist, is unreadable, or contains invalid JSON/an invalid OCI spec schema.","commonSituations":"Typo'd or deleted base_spec_file path in containerd config.toml; hand-edited spec JSON with syntax errors; file created after containerd started with wrong permissions; spec generated for an incompatible OCI spec version.","solutions":["Verify the path in containerd config (plugins.'io.containerd.grpc.v1.cri'.containerd.base_spec_file) exists and is readable by containerd","Validate the JSON with `jq . <file>` or `oci-runtime-tool validate --file <file>` and fix syntax/schema errors","Generate a known-good baseline: `runc spec > /etc/containerd/base-spec.json` and point base_spec_file at it","Remove base_spec_file from config to fall back to the default generated spec, then restart containerd"],"exampleFix":"// before (config.toml)\n[plugins.\"io.containerd.grpc.v1.cri\".containerd]\n  base_spec_file = \"/etc/containerd/basespec.json\"  # file missing\n// after\n[plugins.\"io.containerd.grpc.v1.cri\".containerd]\n  base_spec_file = \"/etc/containerd/base-spec.json\" # exists, valid JSON","handlingStrategy":"validation","validationCode":"// preflight the base spec file before (re)starting containerd\npackage main\nimport (\"encoding/json\", \"fmt\", \"os\")\nfunc checkBaseSpec(path string) error {\n\tb, err := os.ReadFile(path)\n\tif err != nil { return err }\n\tvar s struct { OCIVersion string `json:\"ociVersion\"` }\n\tif err := json.Unmarshal(b, &s); err != nil { return fmt.Errorf(\"invalid JSON: %w\", err) }\n\tif s.OCIVersion == \"\" { return fmt.Errorf(\"missing ociVersion\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"can't load base OCI spec\") {\n\t// fall back: run with default spec (remove base_spec_file) after validating the file\n\tlog.Printf(\"base spec unusable: %v\", err)\n}","preventionTips":["Validate base_spec_file with jq/oci-runtime-tool in config management (Ansible/Helm pre-start hook)","Always start from `runc spec` output and edit minimally","Keep base spec files under version control with CI JSON-schema validation","Verify the path is absolute and readable by the containerd service user before restart"],"tags":["containerd","cri","oci-spec","config"],"backgroundTag":"invalid-oci-spec-file","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}