Kubernetes "RunContainerError" - Fix Container Start Failures in CI

RunContainerError means the container was created but the runtime failed at the start step. The command is not executable, a mount is wrong, or the process could not be launched - the failure happens after create but before the app runs.

What this error means

A pod shows STATUS: RunContainerError. kubectl describe pod reports an OCI runtime start failure - exec: "..." permission denied, executable file not found in $PATH, or a mount error.

Warning  Failed  6s  kubelet  Error: failed to start containerd task:
OCI runtime exec failed: exec: "/entrypoint.sh": permission denied

Common causes

Command is not executable

The entrypoint/script lacks the executable bit, or is a script without a valid shebang, so the runtime cannot exec it (permission denied).

Executable not found in PATH

The command references a binary that is not in the image or not on $PATH, surfacing as executable file not found in $PATH at start.

Mount or permission problem

A read-only root filesystem, a securityContext that blocks the process, or a bad volume mount stops the container from starting.

How to fix it

Inspect the start error

kubectl describe pod <pod> | sed -n '/Events/,$p'

Fix the entrypoint or permissions

1. "permission denied" → chmod +x the entrypoint in the image build, or add a shebang.
2. "executable file not found" → use the correct binary path or install it in the image.
3. If a read-only FS or securityContext blocks it, adjust the mount or context to allow the process.

# in the Dockerfile
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

How to prevent it

• Mark entrypoints executable in the image build and test the image locally.
• Reference binaries by a path that exists in the final image.
• Validate restrictive securityContext settings against the workload before deploy.

Related guides