{"record":{"id":"819dcce67fca3a82","repo":"argoproj/argo-workflows","slug":"failed-to-create-emissary-w","errorCode":null,"errorMessage":"failed to create emissary: %w","messagePattern":"failed to create emissary: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/argoexec/commands/emissary.go","lineNumber":244,"sourceCode":"\t}\n\n\tcmdErr := retry.OnError(backoff, func(error) bool { return true }, func() error {\n\t\tcommand, closer, err := startCommand(ctx, name, args, template, containerName, includeScriptOutput)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to start command: %w\", err)\n\t\t}\n\t\tdefer closer()\n\n\t\tforwardSignals(ctx, signals, command.Process.Pid, false)\n\t\tpid := command.Process.Pid\n\t\tinnerCtx, cancel := context.WithCancel(ctx)\n\t\tdefer cancel()\n\t\tstartFileSignalHandler(innerCtx, pid, containerName)\n\t\tfor _, sidecarName := range template.GetSidecarNames() {\n\t\t\tif sidecarName == containerName {\n\t\t\t\tem, err := emissary.New()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"failed to create emissary: %w\", err)\n\t\t\t\t}\n\n\t\t\t\tgo func() {\n\t\t\t\t\tmainContainerNames := template.GetMainContainerNames()\n\t\t\t\t\terr = em.Wait(innerCtx, mainContainerNames)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\tlogger.WithError(err).WithFields(logging.Fields{\n\t\t\t\t\t\t\t\"mainContainerNames\": mainContainerNames,\n\t\t\t\t\t\t}).Error(innerCtx, \"failed to wait for main container(s)\")\n\t\t\t\t\t}\n\n\t\t\t\t\tlogger.WithFields(logging.Fields{\n\t\t\t\t\t\t\"mainContainerNames\": mainContainerNames,\n\t\t\t\t\t\t\"containerName\":      containerName,\n\t\t\t\t\t}).Info(innerCtx, \"main container(s) exited, terminating container\")\n\t\t\t\t\terr = em.Kill(innerCtx, []string{containerName}, argoexecexecutor.TerminationGracePeriodDuration())\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\tlogger.WithField(\"containerName\", containerName).WithError(err).Error(innerCtx, \"failed to terminate/kill container\")","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/cmd/argoexec/commands/emissary.go#L226-L262","documentation":"When the running container is itself an emissary sidecar (container name appears in template.GetSidecarNames), the executor creates an emissary client via emissary.New() to wait on the main container(s) and terminate itself when they exit. If that client cannot be constructed (its underlying runtime probes/sockets are unavailable), the error is wrapped as \"failed to create emissary\" and the retryable start loop fails.","triggerScenarios":"emissary.New() returns an error — typically the container runtime socket (/run/containerd/containerd.sock or docker.sock) is not mounted into the pod, the runtime gRPC connection is refused, or the detected runtime is unsupported.","commonSituations":"Running with the init-less/emissary container-set executor but the executor kubelet socket/runtime socket volume mounts were stripped by a PodSecurityPolicy/OPA policy; custom runtime class not supported; exec into a sidecar manually for debugging where no runtime socket exists.","solutions":["Check that the container-runtime socket volume (e.g. /run/containerd/containerd.sock) is mounted into executor pods.","Verify the workflow executor's containerRuntimeExecutor / emissary configuration matches the cluster runtime.","Read the wrapped inner error in the pod logs to identify socket-vs-runtime mismatch.","Confirm no admission webhook is dropping the socket hostPath mount from the pod spec.","Pin to an Argo version whose emissary implementation supports your container runtime."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure the runtime socket is mounted in the executor pod spec:\n// kubectl get pod <executor-pod> -o jsonpath='{.spec.containers[*].volumeMounts}' | grep -E 'containerd|docker|crio'","typeGuard":null,"tryCatchPattern":"try {\n  await runWorkflow(containersetTemplate)\n} catch (e) {\n  if (String(e.cause).includes('failed to create emissary')) {\n    // check runtime socket mount + container runtime config\n  }\n}","preventionTips":["Never strip the runtime socket hostPath from executor pods via mutating webhooks.","Verify the emissary executor supports your container runtime before upgrading.","Test containerSet workflows after any Kubernetes/containerd upgrade."],"tags":["kubernetes","argo-workflows","container-runtime","sidecar"],"backgroundTag":"runtime-socket-unavailable","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}