containerd/containerd · error

failed to get container spec: %w

Error message

failed to get container spec: %w

What it means

To build the new spec, updateContainerResources reads the container's current OCI spec via cntr.Container.Spec(ctx). If that containerd API call fails, the error is wrapped as 'failed to get container spec'. This indicates a containerd/metadata or shim-level failure reading the spec, not a bad request.

Source

Thrown at internal/cri/server/container_update_resources.go:96

func (c *criService) updateContainerResources(ctx context.Context,
	cntr containerstore.Container,
	r *runtime.UpdateContainerResourcesRequest,
	status containerstore.Status) (newStatus containerstore.Status, retErr error) {

	newStatus = status
	id := cntr.ID
	// Do not update the container when there is a removal in progress.
	if status.Removing {
		return newStatus, fmt.Errorf("container %q is in removing state", id)
	}

	// Update container spec. If the container is not started yet, updating
	// spec makes sure that the resource limits are correct when start;
	// if the container is already started, updating spec is still required,
	// the spec will become our source of truth for resource limits.
	oldSpec, err := cntr.Container.Spec(ctx)
	if err != nil {
		return newStatus, fmt.Errorf("failed to get container spec: %w", err)
	}
	newSpec, err := updateOCIResource(ctx, oldSpec, r, c.config)
	if err != nil {
		return newStatus, fmt.Errorf("failed to update resource in spec: %w", err)
	}

	if err := updateContainerSpec(ctx, cntr.Container, newSpec); err != nil {
		return newStatus, err
	}
	defer func() {
		if retErr != nil {
			deferCtx, deferCancel := ctrdutil.DeferContext()
			defer deferCancel()
			// Reset spec on error.
			if err := updateContainerSpec(deferCtx, cntr.Container, oldSpec); err != nil {
				log.G(ctx).WithError(err).Errorf("Failed to update spec %+v for container %q", oldSpec, id)
			}
		} else {

View on GitHub (pinned to 4246446a2b)

Solutions

1. Inspect containerd logs for the wrapped inner error (metadata/store failure details)
2. Verify containerd data directory health (disk space, filesystem errors) and restart containerd
3. If the container record is broken, remove the container and recreate it

if strings.Contains(err.Error(), "failed to get container spec") { /* check store health */ }

When it happens

Trigger: Container.Spec(ctx) fails because the container record is gone from the metadata store, the bolt DB is corrupted/locked, or the backing snapshotter/storage is unhealthy.

Common situations: containerd store corruption after unclean shutdown; container removed concurrently between the store Get and the Spec call; disk I/O failures on /var/lib/containerd.

Related errors

• failed to generate container %q spec: %w
• can't load base OCI spec %q: %w
• failed to clone OCI spec: %w
• failed to apply OCI options: %w
• failed to generate spec: %w

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/44d6c85ede7ffc2a. Report an issue: GitHub.