Docker Container & Runtime Errors
The failures that stop a container from running or being reached: the daemon socket is unreachable, an OCI runtime create/exec error, an exec-format (architecture) mismatch, a port already allocated, a bind-mount permission problem, or a container that keeps restarting. Each guide leads with the cause and the `docker run`, `docker inspect`, and `docker logs` commands. Pick your error below, or paste it into the assistant.
Fix your error now
Paste the error or logs and let the Incident Assistant diagnose it, or run a guided triage prompt with AI — no copy-paste.
Every guide in this cluster
69 guides-
'Cannot connect to the Docker daemon' Daemon Connection Failures
Fix 'Cannot connect to the Docker daemon at unix:///var/run/docker.sock' by starting dockerd, fixing DOCKER_HOST, daemon.json, and the active context.
-
'OCI runtime create failed: runc create failed' Container Start Failures
Fix 'OCI runtime create failed: runc create failed' by reading the runc error suffix — missing binary, permission denied, no such file, or bad mount.
-
'port is already allocated' Container Port Bind Failures
Fix Docker 'port is already allocated' and 'address already in use' bind errors: free conflicting containers, host processes, stale docker-proxy, and remap ports.
-
'standard_init_linux.go: exec format error' — Fix CPU Architecture Mismatch
Fix Docker 'standard_init_linux.go exec format error': diagnose arm64-vs-amd64 image mismatches, inspect image architecture, and build multi-arch images with buildx.
-
'bind: address already in use' — Port Conflict on Container Start
Fix 'bind: address already in use' in Docker: find the process or container holding the host port, free it or remap the published port, then restart.
-
'Cannot connect to the Docker daemon at tcp://host:2375' Remote Failure
Fix Docker 'Cannot connect to the Docker daemon at tcp://host:2375' errors: check DOCKER_HOST, the daemon TCP listener, firewall reachability, and TLS on 2376 versus plain 2375.
-
'Cannot connect to the Docker daemon' — Wrong Context Endpoint
Fix 'Cannot connect to the Docker daemon' caused by an active Docker context or DOCKER_HOST pointing at an unreachable endpoint: list, inspect, recreate, and switch back to default.
-
'cannot create directory: Permission denied' — Volume & Bind-Mount Ownership
Fix Docker's 'cannot create directory: Permission denied' on volumes and bind mounts caused by UID/GID mismatches between the container user and host directory ownership.
-
'cannot find cgroup mount destination: unknown' — Fix cgroup Mounts
Fix 'cannot find cgroup mount destination: unknown' in Docker: mount the cgroup hierarchy, resolve cgroup v1/v2 mismatches inside privileged and DinD containers, and restart the daemon.
-
'Cannot kill container: did not receive an exit event' — Recover a Stuck Container
Fix Docker 'Cannot kill container: did not receive an exit event' caused by dockerd/containerd desync or a D-state process. Diagnose with ps state and restart containerd.
-
'Cannot kill container: is not running' — Already-Stopped Container
Fix 'Cannot kill container: Container is not running': the target already exited. Learn to check state with docker ps, use rm/start correctly, and script idempotent stops.
-
'cannot stop container: permission denied' — Fix Daemon and Cgroup Signal Failures
Fix Docker 'cannot stop container permission denied': diagnose docker socket access, rootless and SELinux/AppArmor policies, stuck cgroups, and kill signals the runtime cannot deliver.
-
'cgroups: cgroup mountpoint does not exist' — Align the cgroup Driver
Fix Docker's OCI 'cgroup mountpoint does not exist' error: reconcile the cgroup v2 systemd-vs-cgroupfs driver mismatch by setting native.cgroupdriver=systemd in daemon.json and restarting.
-
'Connection refused' — Container Can't Reach the Host
Fix a Docker container that can't reach host or peer services: use host.docker.internal with host-gateway, pick bridge vs host networking, publish ports, and open the firewall.
-
'Container is not running' — Why exec and Restart Fail
Fix Docker 'Container is not running': find why the container exited, read logs and exit codes, inspect the entrypoint, and keep long-running processes alive in the foreground.
-
'Container is restarting, wait until the container is running' — Fix Crash Loops
Fix Docker 'container is restarting, wait until the container is running': diagnose crash loops from restart policies, read logs and exit codes, and stop the restart cycle safely.
-
'container name is already in use' — Fix Naming Conflicts on docker run
Fix 'Conflict. The container name is already in use' in Docker: remove or rename the existing container, use --rm, and stop leftover containers from prior runs.
-
'controller not available' cgroup v2 Resource Limits
Fix Docker's 'failed to write ... cgroup ... controller not available' error on cgroup v2 hosts: enable delegated cpu/memory controllers under systemd and set limits.
-
'daemon.json: invalid character looking for beginning of object key string' — Fix the JSON
Fix Docker's daemon.json 'invalid character' startup error: locate the trailing comma or stray brace, validate with jq or python, read journalctl, and restart the daemon cleanly.
-
'depends_on condition is not supported' Compose Failure
Fix Docker Compose 'service depends_on ... condition ... is not supported' error: enable the long depends_on syntax, use condition service_healthy, and pick a compatible Compose version.
-
'device or resource busy' Volume and Mount Removal Failures
Fix Docker 'device or resource busy' on volume rm: find containers still using the volume, clear stale mounts, and release busy bind targets safely.
-
'devmapper: Thin Pool has free data blocks less than minimum required'
Fix Docker's 'devmapper: Thin Pool has <N> free data blocks which is less than minimum required' error: reclaim, extend the thin pool, or migrate off devicemapper.
-
'dial unix /var/run/docker.sock: connect: connection refused'
Fix 'dial unix /var/run/docker.sock: connect: connection refused': the Docker daemon is down or the socket is stale. Start dockerd, check the socket, and fix permissions.
-
'driver failed programming external connectivity' — Port Publish Fails
Fix 'driver failed programming external connectivity on endpoint': a port already in use, a stale iptables rule, or a dead daemon. Free the port or restart Docker to recover.
-
'error creating overlay mount ... no such file or directory' — overlay2 Corruption
Fix Docker's 'error creating overlay mount to /var/lib/docker/overlay2/<id>/merged: no such file or directory' caused by missing or corrupted overlay2 layer directories.
-
'Error initializing network controller' Daemon Startup Failure
Fix dockerd 'Error initializing network controller' bridge and NAT failures: repair iptables, firewalld, the docker0 bridge, ip_forward, and corrupt network state.
-
'error mounting to rootfs' — Fix Container Mount Setup
Fix Docker 'error mounting to rootfs': resolve missing bind sources, file-vs-directory mismatches, SELinux labels, and read-only paths so the OCI runtime can set up container mounts and start.
-
'error while creating mount source path: operation not permitted' — Share the Path or Fix Ownership
Fix Docker 'error while creating mount source path: operation not permitted' by sharing the path in Docker Desktop File Sharing or fixing Linux host permissions and SELinux.
-
'exec /entrypoint.sh: no such file or directory' Entrypoint Startup Failures
Fix Docker 'exec /entrypoint.sh: no such file or directory': repair CRLF line endings, missing shells, wrong arch, and unset executable bits on entrypoints.
-
'failed to create endpoint on network bridge: address already in use' — Port/IP Clash
Fix 'failed to create endpoint on network bridge: address already in use': free the clashing host port or static IP, clear stale endpoints, restart.
-
'failed to create shim task' Containerd Runtime Startup Failures
Fix Docker 'failed to create shim task': repair runc/containerd-shim issues, cgroup v2 misconfig, OCI runtime errors, and missing kernel features.
-
'failed to export image' buildx Export and Push Failure
Fix Docker buildx 'failed to solve: failed to export image' errors: diagnose registry auth, cache export, --output, and --push problems and get builds exporting cleanly.
-
'failed to mount local volume: no such file or directory' — Missing Bind Source
Fix Docker's 'failed to mount local volume: mount /<path>: no such file or directory' error caused by missing bind-mount source paths or bad volume device options.
-
'failed to mount overlay: invalid argument' overlay2 Storage Failures
Fix 'failed to mount overlay: invalid argument' in Docker: resolve missing d_type on xfs, unsupported kernels, symlink-depth limits, corrupted overlay2, and driver mismatches.
-
'failed to set up container networking' Bridge and IP Allocation Failures
Fix Docker 'failed to set up container networking': repair the docker0 bridge, exhausted IP pools, missing iptables/nftables rules, and stale network state.
-
'hcsshim::CreateComputeSystem failed' Windows Container Failure
Fix Docker's Windows 'hcsshim::CreateComputeSystem ... failed' error: diagnose host/container OS build mismatches and pick the right process or hyperv isolation mode.
-
'health: starting → unhealthy' — Fix a Failing HEALTHCHECK
Fix a Docker container stuck (unhealthy): read State.Health, run the HEALTHCHECK manually, and tune interval, timeout, retries, and start-period so healthy containers pass.
-
'image is being used by running container' — Cannot Delete Image
Fix 'conflict: unable to delete image - image is being used by running container': stop and remove the dependent containers first, then remove the image or re-tag safely.
-
'input/output error' on /var/lib/docker/overlay2 — Filesystem Corruption
Fix Docker's 'input/output error' reading /var/lib/docker/overlay2, caused by underlying disk or filesystem corruption, and recover the data root safely.
-
'invalid mount config for type "bind"' Bind Mount Failures
Fix Docker's invalid mount config for type bind error: create missing host paths, use absolute paths, enable Desktop file sharing, and set SELinux labels.
-
'invalid volume specification' — Fix Mount Syntax
Fix Docker 'invalid volume specification': correct -v/--mount syntax, Windows path colons, missing container paths, relative sources, and named-volume vs bind-mount confusion so mounts attach.
-
'iptables: No chain/target/match by that name' — Broken Firewall Chains
Fix 'iptables: No chain/target/match by that name' in Docker: restore the DOCKER chains a firewall flush removed by restarting the daemon cleanly.
-
'mkdir: read-only file system' — Fix Read-Only Containers and Mounts
Fix Docker 'mkdir read-only file system': diagnose --read-only containers, read-only bind mounts, and writes to immutable image layers, then add writable volumes or tmpfs correctly.
-
'Mounts denied: The path is not shared from the host' — Desktop File Sharing
Fix Docker Desktop's 'Mounts denied: The path is not shared from the host and is not known to Docker' error by configuring file sharing for bind-mounted paths.
-
'network <name> not found' — Missing or Stale Docker Network
Fix 'network not found' in Docker: recreate the missing network, repair stale Compose references, reconnect containers, and clean up dangling IDs.
-
'Network declared as external, but could not be found' — Compose
Fix 'Network declared as external, but could not be found' in Compose: create the external network first, match the real name, or drop the external flag to auto-create it.
-
'network has active endpoints' — Cannot Remove a Network In Use
Fix 'network has active endpoints' in Docker: find the containers still attached, disconnect or remove them, then delete the network cleanly.
-
'newuidmap: write to uid_map failed' Rootless Setup
Fix rootless Docker's 'newuidmap: write to uid_map failed: Operation not permitted' error: repair /etc/subuid, /etc/subgid, and the setuid bit on newuidmap/newgidmap.
-
'no space left on device' Docker Disk Exhaustion
Fix 'no space left on device' in Docker: reclaim disk from images, containers, volumes, and build cache, free inodes, rotate logs, and relocate or grow /var/lib/docker.
-
'no space left on device' with Free Bytes — Fix Inode Exhaustion
Fix Docker 'no space left on device' when df -h shows free space but df -i shows 100% IUse: inode exhaustion. Prune layers, and reformat with a higher inode ratio.
-
'No such container' — Fix Missing Container References
Fix 'Error response from daemon: No such container' in Docker: check exact names and IDs, list all containers, and handle removed or auto-cleaned containers.
-
'nvidia-container-cli: initialization error' on --gpus all
Fix Docker's 'nvidia-container-cli: initialization error' when running --gpus all: repair the NVIDIA driver / Container Toolkit mismatch and the runtime hook.
-
'OCI runtime exec failed: permission denied' — Fix Non-Executable Entrypoints
Fix Docker 'OCI runtime exec failed permission denied': set the executable bit on entrypoints, handle CRLF and missing interpreters, and resolve noexec mounts and security policies.
-
'OCI runtime exec failed: read-only file system' — Add Writable Paths
Fix Docker's OCI runtime 'read-only file system' error from --read-only containers: identify which paths the process writes to and mount tmpfs or writable volumes for exactly those.
-
'OOMKilled' Exit Code 137 Out-of-Memory Container Kills
Fix Docker OOMKilled and exit code 137: raise memory limits, make the JVM and Node cgroup-aware, find leaks, and read dmesg to confirm the kernel OOM kill.
-
'overlay2 failed to remove root filesystem: device or resource busy' — Clear Leaked Mounts
Fix Docker's overlay2 'device or resource busy' removal error: find the process or leaked mount holding the merged dir, unmount it, force-remove the container, and stop it recurring.
-
'overlay2/<hash>-init: no such file or directory' — Repair Corrupted Layer State
Fix Docker 'open /var/lib/docker/overlay2/<hash>-init: no such file or directory' from corrupted overlay2 state or an interrupted pull. Remove and re-pull the image, then prune.
-
'permission denied while trying to connect to the Docker daemon socket' Access Errors
Fix 'Got permission denied' on /var/run/docker.sock by adding your user to the docker group, re-logging in, or switching to rootless Docker safely.
-
'ports are not available: exposing port' — Fix Port Binding
Fix Docker 'ports are not available: exposing port TCP': release ports held by the OS, reserved dynamic-port ranges, host firewalls, and Desktop networking so container port publishing succeeds.
-
'pthread_create failed: Operation not permitted' — Fix seccomp Syscall Blocks
Fix Docker 'pthread_create failed: Operation not permitted' and runc EPERM caused by an old seccomp profile blocking clone3. Update Docker/runc or loosen the seccomp profile.
-
'the buildx builder container is not running' BuildKit Failure
Fix Docker Buildx's 'buildkit ... the buildx builder container is not running' error: diagnose stopped builder containers, restart the builder, or recreate the buildx instance.
-
'the input device is not a TTY' in CI and Scripts
Fix Docker's 'the input device is not a TTY' error from docker run/exec -it in CI or non-interactive shells: drop the -t flag and run containers cleanly in pipelines.
-
'This node is not a swarm manager' creating an overlay network
Fix Docker's 'cannot create overlay network ... requires swarm mode' / 'This node is not a swarm manager' error: init swarm or use an attachable overlay correctly.
-
'unsupported media type' — Fix Registry Manifest Pulls
Fix Docker 'unsupported media type': resolve OCI vs Docker manifest mismatches, old daemons rejecting new formats, non-registry endpoints, and proxy rewrites so pulls and pushes work.
-
'userns-remap' subuid/subgid and Bind-Mount Permission Failure
Fix Docker userns-remap errors: diagnose missing subuid/subgid ranges, daemon startup failures, and 'permission denied' on bind mounts after enabling user-namespace remapping.
-
'Version is unsupported' — The Obsolete Compose version Key
Fix 'Version in docker-compose.yml is unsupported': the top-level version key is obsolete in Compose v2. Remove it, or upgrade Compose to match your file schema.
-
'volume is in use' — Cannot Remove a Volume Bound to a Container
Fix Docker's 'Error response from daemon: remove <vol>: volume is in use' by finding and removing the containers referencing the volume before deleting it safely.
-
'You cannot remove a running container' — Fix Container Removal Failures
Fix 'You cannot remove a running container' in Docker: stop the container first, use docker rm -f to force removal, and handle restart loops safely.
-
'OCI runtime exec failed — executable file not found in $PATH'
Fix Docker's 'OCI runtime exec failed: unable to start container process: exec: executable file not found in $PATH' — install the binary, use an absolute path, or fix exec vs shell form.
Docker with AI AI prompts
Copy-paste, production-safe prompts for this stack.
Docker with AI command center
Top errors, validators, and runbooks for the whole stack.
Frequently asked questions
Why "Cannot connect to the Docker daemon at unix:///var/run/docker.sock"?
systemctl status docker, start it, and add your user to the docker group (or use sudo). For remote daemons, verify DOCKER_HOST. See cannot connect to the daemon.What does "exec format error" / standard_init_linux mean?
--platform. See exec format error."Port is already allocated" — how do I fix it?
docker ps / ss -ltnp, then stop it or map a different host port. See port is already allocated.