Kubernetes "failed to pull and unpack image" (containerd) - Fix in CI
By Daniel Zoghalchali·Latchkey
containerd fetched the image manifest but failed while pulling or unpacking a layer. The pull got past resolution - the failure is in downloading/extracting layer content: a corrupt or truncated layer, no disk to unpack into, or a media type the runtime cannot handle.
What this error means
kubectl describe pod shows failed to pull and unpack image "..." followed by failed to extract layer / unexpected EOF / no space left on device. It is distinct from a 401/404 - auth and the manifest were fine; unpacking the layers failed.
kubectl describe pod
Failed to pull image "registry/api:1.0": rpc error: code = Unknown desc =
failed to pull and unpack image "...": failed to extract layer
sha256:...: write /var/lib/containerd/...: no space left on device
Diagnose it: read events and previous logs
Terminal
kubectl --context "$KUBE_CONTEXT" -n "$NS" get pods -o wide
kubectl -n "$NS" describe pod <pod> | sed -n "/Events/,$p"
kubectl -n "$NS" logs <pod> --previous --tail=50
Common causes
Node out of disk for unpacking
containerd unpacks layers under /var/lib/containerd. If the node disk is full, extraction fails with no space left on device even though the download started.
Corrupt or truncated layer
A layer downloaded partially (network drop) or is corrupt in the registry, so extraction hits unexpected EOF or a digest mismatch.
Unsupported media type / compression
An image using a compression (e.g. zstd) or media type the node’s containerd version does not support fails to unpack.
How to fix it
Read the unpack error and check node disk
The message tells you which sub-failure it is; disk pressure is the most common.
Terminal
kubectl describe pod <pod> | grep -A2 -i 'pull and unpack'
kubectl describe node <node> | grep -A3 -i 'DiskPressure\|ephemeral'
Fix by the sub-cause
"no space left on device" → free node disk (prune images/logs) or use larger disks; the kubelet GC may also reclaim space.
EOF / digest mismatch → re-push the image; a transient network drop often clears on the next pull attempt.
Unsupported media type → rebuild the image with a compatible compression, or upgrade the node’s containerd.
How to prevent it
Keep node disks sized and garbage-collected so layers can unpack.
Push images with widely supported media types/compression.
Mirror images so a corrupt/transient registry layer can be re-fetched.
Frequently asked questions
What causes Kubernetes "failed to pull and unpack image" (containerd)?
There are 3 common causes: node out of disk for unpacking, corrupt or truncated layer, and unsupported media type / compression. containerd unpacks layers under /var/lib/containerd.
How do I fix Kubernetes "failed to pull and unpack image" (containerd)?
There are 2 fixes depending on which cause you have: read the unpack error and check node disk and fix by the sub-cause. Work through them in order, since the first is the most common.
What does Kubernetes "failed to pull and unpack image" (containerd) actually mean?
kubectl describe pod shows failed to pull and unpack image "..." followed by failed to extract layer / unexpected EOF / no space left on device.
How do I stop Kubernetes "failed to pull and unpack image" (containerd) happening again?
Keep node disks sized and garbage-collected so layers can unpack. The prevention section lists 3 changes that keep it from recurring.
