containerd/containerd · error

RDT disabled, refusing to set RDT class of container %q to %

Error message

RDT disabled, refusing to set RDT class of container %q to %q

What it means

rdtClassFromAnnotations (internal/cri/server/rdt.go:36) extracts an RDT (Resource Director Technology) class from container/pod annotations via rdt.ContainerClassFromAnnotations. If an annotation assigns a class but the RDT feature is not enabled in the containerd config (rdt.IsEnabled() is false), containerd refuses to silently ignore the class and returns this error. It can be suppressed per-config with ignore_rdt_not_enabled_errors.

Source

Thrown at internal/cri/server/rdt.go:36

package server

import (
	"fmt"

	"github.com/containerd/containerd/v2/pkg/rdt"
	"github.com/containerd/log"
)

// rdtClassFromAnnotations examines container and pod annotations of a
// container and returns its effective RDT class.
func (c *criService) rdtClassFromAnnotations(containerName string, containerAnnotations, podAnnotations map[string]string) (string, error) {
	cls, err := rdt.ContainerClassFromAnnotations(containerName, containerAnnotations, podAnnotations)

	if err == nil {
		// Our internal check that RDT has been enabled
		if cls != "" && !rdt.IsEnabled() {
			err = fmt.Errorf("RDT disabled, refusing to set RDT class of container %q to %q", containerName, cls)
		}
	}

	if err != nil {
		if !rdt.IsEnabled() && c.config.ContainerdConfig.IgnoreRdtNotEnabledErrors {
			log.L.Debugf("continuing create container %s, ignoring rdt not enabled (%v)", containerName, err)
			return "", nil
		}
		return "", err
	}

	return cls, nil
}

View on GitHub (pinned to 4246446a2b)

Solutions

1. Enable RDT in containerd config (rdt section, requires kernel resctrl support and intel-cmt-cat) and restart containerd, if RDT is actually desired.
2. Set ignore_rdt_not_enabled_errors = true in the CRI plugin config to log-and-continue instead of failing container creation.
3. Remove the RDT annotations from the pod spec / RuntimeClass if the feature is not intended.
4. Verify kernel support: check /sys/fs/resctrl exists and CPU has RDT (cat /proc/cpuinfo | grep rdt_a).

Example fix

# before (config.toml)
[plugins."io.containerd.grpc.v1.cri".containerd]
  # rdt not configured, but pod has rdt annotation

# after
[plugins."io.containerd.grpc.v1.cri".containerd]
  ignore_rdt_not_enabled_errors = true

// Before scheduling a pod with RDT annotations, ensure runtime support:
if pod.Annotations["io.containers.rdt"] != "" && !rdtEnabledOnNode(node) {
    // don't request an RDT class, or set ignore_rdt_not_enabled_errors in containerd config
}

cls, err := rdtClassFromAnnotations(name, cAnn, pAnn)
if err != nil {
    if errors.Is(err, errRdtDisabled) && cfg.IgnoreRdtNotEnabledErrors {
        cls = "" // proceed without RDT class
    } else {
        return err
    }
}

When it happens

Trigger: A pod or container annotation (io.containers.rdt / pod RDT annotations) specifies a non-empty RDT class while containerd was started without RDT enabled (no [plugins."io.containerd.cri.v1.runtime".containerd] rdt config / resctrl unavailable), during buildLinuxSpec at container creation.

Common situations: Moving workloads from an RDT-enabled node to a node without RDT support or without the containerd RDT config; missing intel-cmt-cat / resctrl mount or kernel without RDT; kubelet/RuntimeClass configs carrying RDT annotations applied cluster-wide.

Related errors

• failed to set RDT class: %w
• resource is unreasonably small (< 1kbit)
• resource is unreasonably large (> 1Pbit)
• no runtime for %q is configured
• invalid stream server configuration: %w

AI-assisted analysis of containerd/containerd@4246446a2b (2026-09-02). Data as JSON: /api/errors/150544afa881387e. Report an issue: GitHub.