Kubernetes Pod Stuck in "ContainerCreating" - Diagnose the Real Blocker in CI

By Kaveh Alemi·Latchkey

ContainerCreating is a holding state, not a root cause. The kubelet is partway through preparing the pod - mounting volumes, fetching secrets, pulling the image, or setting up the sandbox - and one of those steps is stuck. The real reason is always in the pod events.

What this error means

A pod sits at STATUS: ContainerCreating for minutes and never reaches Running. kubectl get pod shows no restarts; the container has not started yet. The blocker is whatever event keeps repeating under kubectl describe pod.

kubectl output

NAME                   READY   STATUS              RESTARTS   AGE
api-7d9f8c6b54-2xk9p   0/1     ContainerCreating   0          4m
# describe shows the actual blocker, e.g. FailedMount / FailedCreatePodSandBox /
# image pull in progress

Common causes

A volume cannot be mounted or attached

A missing Secret/ConfigMap, an unbound PVC, or a slow/failed CSI attach keeps the kubelet from finishing mount, so the pod stays in ContainerCreating.

The sandbox/network is not ready

A FailedCreatePodSandBox (CNI cannot assign an IP, plugin unhealthy) blocks every container from starting and holds the pod in ContainerCreating.

The image is still pulling

A large or slow image pull keeps the pod in ContainerCreating until the image lands; if the pull fails it transitions to ErrImagePull/ImagePullBackOff instead.

How to fix it

Read the events to find the actual cause

The status is generic; the events are specific. Always start here.

Terminal

kubectl describe pod <pod> | sed -n '/Events/,$p'
kubectl get events --field-selector involvedObject.name=<pod> --sort-by=.lastTimestamp

Follow the specific event to its fix

FailedMount / MountVolume.SetUp → fix the missing Secret/ConfigMap, PVC binding, or CSI attach.
FailedCreatePodSandBox → fix the CNI (IP exhaustion, unhealthy plugin).
Pulling image (no failure yet) → wait, or speed up the pull; if it errors it becomes ImagePullBackOff.

How to prevent it

Treat ContainerCreating as "read the events", not a cause to fix directly.
Apply mounted Secrets/ConfigMaps and bind PVCs before the workload.
Keep CNI and CSI plugins healthy so sandbox and mount steps complete.

Frequently asked questions

Why is my pod in ContainerCreating but the logs are empty?

There are no logs because no container has started yet - the kubelet is still in the prepare phase (mount, secret, sandbox, pull). kubectl logs has nothing to show until a container runs. Use kubectl describe pod and the events to see what is blocking the prepare step.