Kubernetes "failed to pull and unpack image" (containerd) - Fix in CI

containerd fetched the image manifest but failed while pulling or unpacking a layer. The pull got past resolution - the failure is in downloading/extracting layer content: a corrupt or truncated layer, no disk to unpack into, or a media type the runtime cannot handle.

What this error means

kubectl describe pod shows failed to pull and unpack image "..." followed by failed to extract layer / unexpected EOF / no space left on device. It is distinct from a 401/404 - auth and the manifest were fine; unpacking the layers failed.

kubectl describe pod

Failed to pull image "registry/api:1.0": rpc error: code = Unknown desc =
failed to pull and unpack image "...": failed to extract layer
sha256:...: write /var/lib/containerd/...: no space left on device

Common causes

Node out of disk for unpacking

containerd unpacks layers under /var/lib/containerd. If the node disk is full, extraction fails with no space left on device even though the download started.

Corrupt or truncated layer

A layer downloaded partially (network drop) or is corrupt in the registry, so extraction hits unexpected EOF or a digest mismatch.

Unsupported media type / compression

An image using a compression (e.g. zstd) or media type the node’s containerd version does not support fails to unpack.

How to fix it

Read the unpack error and check node disk

The message tells you which sub-failure it is; disk pressure is the most common.

Terminal

kubectl describe pod <pod> | grep -A2 -i 'pull and unpack'
kubectl describe node <node> | grep -A3 -i 'DiskPressure\|ephemeral'

Fix by the sub-cause

"no space left on device" → free node disk (prune images/logs) or use larger disks; the kubelet GC may also reclaim space.
EOF / digest mismatch → re-push the image; a transient network drop often clears on the next pull attempt.
Unsupported media type → rebuild the image with a compatible compression, or upgrade the node’s containerd.

How to prevent it

Keep node disks sized and garbage-collected so layers can unpack.
Push images with widely supported media types/compression.
Mirror images so a corrupt/transient registry layer can be re-fetched.