kubernetes/kubernetes · error

Failed to init image service, error: %w

Error message

Failed to init image service, error: %w

What it means

Returned from run() (hollow_node.go:264) when remote.NewRemoteImageServiceBuilder().WithEndpoint(c.ImageServiceEndpoint).WithConnectionTimeout(15*time.Second).Build(ctx) fails. This branch runs only when --use-host-image-service=true, which is the DEFAULT (line 107), so most hollow-kubelet deployments exercise it. Build dials the host's real CRI image service endpoint with a 15s timeout.

Source

Thrown at cmd/kubemark/app/hollow_node.go:264

			return fmt.Errorf("Failed to start fake runtime, error: %w", err)
		}
		defer fakeRemoteRuntime.Stop()
		runtimeService, err := remote.NewRemoteRuntimeServiceBuilder().
			WithEndpoint(endpoint).
			WithConnectionTimeout(15 * time.Second).
			Build(ctx)
		if err != nil {
			return fmt.Errorf("Failed to init runtime service, error: %w", err)
		}

		var imageService internalapi.ImageManagerService = fakeRemoteRuntime.ImageService
		if config.UseHostImageService {
			imageService, err = remote.NewRemoteImageServiceBuilder().
				WithEndpoint(c.ImageServiceEndpoint).
				WithConnectionTimeout(15 * time.Second).
				Build(ctx)
			if err != nil {
				return fmt.Errorf("Failed to init image service, error: %w", err)
			}
		}

		hollowKubelet := kubemark.NewHollowKubelet(
			f, c,
			client,
			heartbeatClient,
			cadvisorInterface,
			imageService,
			runtimeService,
			containerManager,
		)
		hollowKubelet.Run(ctx)
	}

	if config.Morph == "proxy" {
		clientConfig.UserAgent = "hollow-proxy"

View on GitHub (pinned to b882c60b40)

Solutions

1. Confirm the host CRI socket exists and the kubemark UID can access it: `ls -l <socket>` and `crictl --runtime-endpoint <socket> info`.
2. Pass the correct endpoint via the image-service flag, or set --use-host-image-service=false to use the fake image service instead.
3. Verify the host container runtime (containerd/CRI-O) is running.
4. Relax permissions/SELinux so kubemark can dial the socket.

Example fix

// before - default uses host image service which may not exist on the host
// (run with defaults, fails at 264)

// after - opt out of the host image service for a pure benchmark hollow node
./kubemark --morph kubelet --use-host-image-service=false

func validateHostImageEndpoint(endpoint string) error {
    if endpoint == "" {
        return errors.New("host image service endpoint is empty but --use-host-image-service=true")
    }
    if !strings.HasPrefix(endpoint, "unix://") {
        // cri-client accepts a bare path too, but be explicit
    }
    if _, err := os.Stat(strings.TrimPrefix(endpoint, "unix://")); err != nil {
        return fmt.Errorf("host image socket %q not accessible: %w", endpoint, err)
    }
    return nil
}

imageService, err = remote.NewRemoteImageServiceBuilder().
    WithEndpoint(c.ImageServiceEndpoint).
    WithConnectionTimeout(15 * time.Second).
    Build(ctx)
if err != nil {
    return fmt.Errorf("dial host image service %q (15s): %w", c.ImageServiceEndpoint, err)
}

When it happens

Trigger: c.ImageServiceEndpoint points at a host CRI socket (e.g. /var/run/containerd/containerd.sock) that is missing, unreadable, or whose server is not responding within 15s; the socket path is wrong for the container runtime installed on the host.

Common situations: Running hollow-kubelet on a host without containerd/CRI-O; wrong --image-service-endpoint for the host runtime; the host runtime is stopped/crashed; permissions on the host socket exclude the kubemark UID; SELinux/AppArmor denying the socket.

Related errors

• Failed to init runtime service, error: %w
• Failed to generate fake endpoint, error: %w
• Failed to start fake runtime, error: %w
• no 'sandboxImage' field in CRI info config
• empty list of supported gRPC services (aka supported version

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/df56b91b09fdaa5a. Report an issue: GitHub.