containerd/containerd · error

failed to set RDT class: %w

Error message

failed to set RDT class: %w

What it means

Analogous to blockio: the CRI layer resolves an RDT (Resource Director Technology) class from container/sandbox annotations via rdtClassFromAnnotations and wraps any failure with this error during buildLinuxSpec. RDT classes map to Intel CAT/MBA allocations managed by the resctrl interface; an invalid class cannot be applied to the container.

Source

Thrown at internal/cri/server/container_create.go:860

	supplementalGroups := securityContext.GetSupplementalGroups()

	// Get blockio class
	blockIOClass, err := c.blockIOClassFromAnnotations(config.GetMetadata().GetName(), config.Annotations, sandboxConfig.Annotations)
	if err != nil {
		return nil, fmt.Errorf("failed to set blockio class: %w", err)
	}
	if blockIOClass != "" {
		if linuxBlockIO, err := blockio.ClassNameToLinuxOCI(blockIOClass); err == nil {
			specOpts = append(specOpts, oci.WithBlockIO(linuxBlockIO))
		} else {
			return nil, err
		}
	}

	// Get RDT class
	rdtClass, err := c.rdtClassFromAnnotations(config.GetMetadata().GetName(), config.Annotations, sandboxConfig.Annotations)
	if err != nil {
		return nil, fmt.Errorf("failed to set RDT class: %w", err)
	}
	if rdtClass != "" {
		specOpts = append(specOpts, oci.WithRdt(rdtClass, "", ""))
	}

	for pKey, pValue := range util.GetPassthroughAnnotations(sandboxConfig.Annotations,
		ociRuntime.PodAnnotations) {
		specOpts = append(specOpts, customopts.WithAnnotation(pKey, pValue))
	}

	for pKey, pValue := range util.GetPassthroughAnnotations(config.Annotations,
		ociRuntime.ContainerAnnotations) {
		specOpts = append(specOpts, customopts.WithAnnotation(pKey, pValue))
	}

	// Default target PID namespace is the sandbox PID.
	targetPid := sandboxPid
	// If the container targets another container's PID namespace,

View on GitHub (pinned to 4246446a2b)

Solutions

1. Ensure the node's RDT configuration (/etc/containerd/[rdt].yaml classes) contains the annotated class name
2. Correct the RDT annotation value in the pod spec
3. Verify RDT support (lscpu: RDT/CAT flags) and that the container's CPUs are within the resctrl enabled cpuset
4. Inspect containerd logs for the wrapped inner error from rdtClassFromAnnotations
5. Drop the RDT annotation if RDT is not needed

Example fix

// before
io.containerd.cri.v0.rdt/rdt: gold-class    # not defined on node
// after
io.containerd.cri.v0.rdt/rdt: guaranteed    # class present in RDT config

const rdtKey = "io.containerd.cri.v0.rdt/rdt";
const cls = annotations?.[rdtKey];
if (cls && !nodeRdtClasses.includes(cls)) {
  throw new Error(`RDT class '${cls}' not defined in node RDT config`);
}

function hasValidRdtClass(a, known) {
  const v = a?.["io.containerd.cri.v0.rdt/rdt"];
  return v === undefined || (typeof v === "string" && known.includes(v));
}

try {
  await createContainer(cfg);
} catch (e) {
  if (String(e?.message).includes("failed to set RDT class")) {
    // drop the RDT annotation and retry, or alert node-config mismatch
  }
  throw e;
}

When it happens

Trigger: CreateContainer with an RDT annotation (io.containerd.cri.v0.rdt/...) whose value fails parsing or refers to a class not defined in the node's RDT configuration, or the container's pod is not in the resctrl enabled-cpuset.

Common situations: Pods scheduled onto nodes whose RDT config lacks the referenced class; annotation value malformed; the container's requested CPUs fall outside the resctrl schemata cpus range; kernel/hardware lacks RDT support while annotations are set.

Related errors

• failed to set blockio class: %w
• RDT disabled, refusing to set RDT class of container %q to %
• unable to load CRI runtime service plugin dependency: %w
• unable to load CRI image service plugin dependency: %w
• failed to create CRI service: %w

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/b04efb8d366ab7db. Report an issue: GitHub.