Free tools Windows power users keep installed
One-click scans. No signup required.
If Pods stopped starting immediately after you enabled cgroup v2, first identify which layer is failing: the kubelet, the container runtime while creating the Pod sandbox, or the application after the container has already started. Then verify that every node is really using cgroup v2, confirm kernel and runtime support, and align the kubelet and runtime on the systemd cgroup driver. On an existing node, replacing the node is often safer than editing the driver and merely restarting kubelet.
Identify the failure layer before changing configuration
“Pod failed to start” can describe three different events. The repair depends on which event appears in your evidence.
As an Amazon Associate I earn from qualifying purchases.
| Failure layer | Typical evidence | What it means |
|---|---|---|
| Kubelet or node | kubectl get nodes shows NotReady; kubelet will not start; node service logs contain startup errors |
The node agent cannot initialize or manage its cgroup hierarchy. |
| Runtime and Pod sandbox | Pod events show FailedCreatePodSandbox, container-creation errors, or runtime failures |
The kubelet is running, but the CRI runtime cannot create the sandbox or container with the selected cgroup settings. |
| Application process | The container is created, then the process exits, crashes, or is OOM-killed | Container creation succeeded. The process or an agent may not understand cgroup-v2 limits. |
Collect evidence without assuming the cause. Run kubectl get nodes, inspect the affected Pod with kubectl describe pod <pod-name>, and review node-side logs with journalctl -u kubelet and the corresponding runtime service. Record the exact event text and whether the failure happens before or after the container is created.
Confirm that the node is actually using cgroup v2
A boot-parameter change or distribution upgrade may have affected only some nodes. Check every affected Linux node directly:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
stat -fc %T /sys/fs/cgroup/cgroup2fsmeans the mounted hierarchy is cgroup v2.tmpfsmeans the node is still using cgroup v1.
Do not infer the result from the fact that one node booted successfully. A cluster can contain mixed hierarchies, especially during a rolling migration, and a workload may land on a node with different behavior.
Also record the distribution, kernel release, Kubernetes release, runtime and runtime version, and whether systemd is the init system. Kubernetes requires a Linux kernel 5.8 or later for cgroup v2. The Kubernetes documentation lists containerd 1.4 or later and CRI-O 1.20 or later as examples of runtimes with cgroup-v2 support; these are examples, not a blanket compatibility guarantee for every Kubernetes and runtime release combination.
Kubernetes documentation states that “The kubelet automatically detects that the OS is running on cgroup v2 and performs accordingly with no additional configuration required.” That detection does not remove the requirements for a supported runtime or matching cgroup drivers. A node can be correctly detected as v2 and still fail when kubelet and the runtime use incompatible managers.
Use matching cgroup drivers on systemd-based nodes
With cgroup v2 and systemd as the init system, configure both kubelet and the container runtime to use the systemd cgroup driver. Running Kubernetes with cgroupfs while systemd manages other cgroups creates two competing managers. Under resource pressure, that arrangement can produce unstable hierarchies and inconsistent resource accounting.
Check the effective kubelet setting
The kubelet configuration field is:
cgroupDriver: systemdOn kubeadm-managed clusters created with Kubernetes 1.22 or later, an unset kubelet driver defaults to systemd. The generated per-node configuration is commonly located at /var/lib/kubelet/config.yaml. Verify the effective setting and any command-line overrides rather than assuming that file is the only authority. Distribution packages and service drop-ins can supply additional flags.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Inspect the running service definition and the kubelet’s startup arguments using your operating system’s service tools. The important result is the setting kubelet actually starts with, not merely a value present in an unused configuration file.
Configure containerd 1.x
For containerd 1.x, the Kubernetes-documented runtime option is:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
SystemdCgroup = truePlace the option in the active containerd configuration, preserving the existing plugin and runtime structure. A package build may disable the CRI integration plugin; verify that the CRI plugin is enabled before diagnosing a cgroup setting that the runtime never loaded.
Configure containerd 2.x
Containerd 2.x uses a different plugin table:
[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
SystemdCgroup = trueDo not copy the 1.x table into a 2.x configuration or the 2.x table into a 1.x configuration. The correct path depends on the installed major version and package layout. Confirm the runtime’s effective configuration after editing it.
Check CRI-O
Kubernetes documentation identifies systemd as CRI-O’s default cgroup manager. Still verify the effective CRI-O configuration on the installed release and keep it aligned with kubelet. A default is not proof that a distribution override, drop-in, or older package has not changed the setting.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Restart only in a maintenance window
Changing the runtime configuration requires a planned restart of the runtime service. Coordinate this with workload availability, disruption budgets, and the node’s drain procedure. Restarting the runtime can interrupt existing containers, and changing the manager on a live node introduces an additional migration risk.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why a driver mismatch causes sandbox and container-creation errors
Kubelet creates and manages Pod-level cgroups, while the CRI runtime creates the container-level cgroups. If they select different drivers, each component may calculate a different hierarchy or resource path. The result can be a hard-to-interpret sandbox failure, an inability to apply limits, or resource accounting that does not match the Pod specification.
Do not treat a successful kubelet startup as proof that the runtime is compatible. The kubelet may remain healthy until it asks the runtime to create a new sandbox. Conversely, a runtime process can be running while kubelet refuses to start because its own cgroup configuration is invalid.
Repair an existing node safely
Changing the driver on a node that already joined a cluster is more difficult than configuring a new node. Existing Pods were created under the old hierarchy semantics. Kubernetes warns that those Pods may fail when their sandboxes need to be recreated after the runtime changes drivers. The official runtime guidance also warns that “Restarting the kubelet may not solve such errors.”
Preferred approach: replace the node
If your infrastructure automation allows it, build a replacement node with the intended kernel, cgroup mode, runtime, and matching systemd drivers. Then:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Cordon the old node so new workloads do not land on it.
- Drain it according to your workload availability policy. Respect PodDisruptionBudgets and handle workloads that cannot be evicted automatically.
- Join the replacement node to the cluster and verify its labels, taints, runtime, and cgroup hierarchy.
- Allow workloads to be recreated on the replacement, then remove the old node.
This approach creates fresh Pod sandboxes under one consistent hierarchy instead of trying to reinterpret every existing sandbox in place.
When replacement is not available
Use the version-specific kubeadm migration procedure or the procedure supplied by your Kubernetes distribution. Plan for Pod removal and recreation, and test the sequence on a non-production node first. Do not assume that editing a file, restarting kubelet, and waiting will migrate existing sandbox state. Preserve logs and the original configuration so you can roll back or rebuild the node if the migration fails.
Check whether CRI driver discovery applies to your versions
The CRI design allows kubelet to obtain the cgroup driver from the runtime’s RuntimeConfig. Where that capability is supported and enabled, the runtime-reported setting can take precedence over cgroupDriver in kubelet configuration. Support depends on the Kubernetes release, feature gates, runtime implementation, and distribution packaging.
Therefore, do not remove explicit configuration merely because your runtime might support discovery. Check the documentation for the exact Kubernetes and runtime versions installed on the node, confirm whether the feature is enabled, and inspect the runtime-reported value. A configuration that is valid for one release can be ignored or behave differently on another.
Separate post-start crashes and OOM kills from startup failures
If kubectl describe pod shows that the container was created and the process later exited, the cgroup migration may be exposing an application compatibility problem rather than a kubelet or runtime failure.
Memory detection and Node.js
Kubernetes specifically warns that older releases in the Node.js 18 line may not reliably detect cgroup-v2 memory limits. Such a process can read the host’s memory instead of the Pod’s limit and size its heap too aggressively. The container then starts normally but is killed when it exceeds the limit.
Update the application runtime to a cgroup-v2-compatible release where possible. If an upgrade is not immediately possible, set the process heap explicitly to a value that fits within the Pod’s memory limit, leaving room for native memory and sidecars. Treat this as an application-sizing change, not as evidence that the sandbox failed.
Agents that read cgroup files directly
Monitoring, logging, and security agents may read cgroup paths themselves. Versions written for cgroup v1 can report incorrect limits or fail when expected files are absent. Upgrade those agents to versions that document cgroup-v2 support and inspect their own logs separately from kubelet and runtime logs.
Recommended Free Tools
Rootless kind has additional, unrelated limits
For rootless kind, a workload can fail to start because of PID limits or Linux inotify limits even when cgroup configuration is correct. Check the Podman PID limit and the host’s fs.inotify watch and instance settings using the kind rootless guidance. These limits are special-environment checks; do not generalize them as the explanation for a conventional, rootful Kubernetes cluster reporting FailedCreatePodSandbox.
Use this end-to-end troubleshooting sequence
- Classify the event. Use
kubectl get nodes,kubectl describe pod,journalctl -u kubelet, and runtime service logs. Decide whether kubelet, sandbox creation, or the application process is failing. - Verify the hierarchy. Run
stat -fc %T /sys/fs/cgroup/on every affected node and record whether the result iscgroup2fsortmpfs. - Record versions. Capture the Linux distribution, kernel, Kubernetes release, runtime and runtime release, init system, and whether the node is rootless kind.
- Confirm support. Check that the kernel is at least 5.8 and that the installed runtime version supports cgroup v2 for the Kubernetes release you run.
- Compare effective drivers. Verify kubelet’s active
cgroupDriverand the runtime’s active cgroup manager. On systemd nodes, both should besystemd. - Check runtime configuration structure. Use the containerd 1.x or 2.x plugin table that matches the installed major version, and confirm that the CRI plugin is active.
- Assess node history. If the node already hosted Pods under a different driver, prefer cordon, drain, and replacement. If replacement is impossible, follow the exact migration procedure for your Kubernetes distribution and version.
- Recreate and observe. After the controlled change, recreate a test workload and inspect new events. Confirm that the sandbox is created before investigating application-level exits.
- Investigate application behavior. For containers that start and then fail, inspect memory limits, runtime heap sizing, and cgroup-v2 support in the application and agents.
What to do if the node is still on cgroup v1
A report that the cluster “switched to cgroup v2” may be incorrect for one or more nodes. If the command returns tmpfs, you are looking at cgroup v1, not a failed v2 runtime.
Kubernetes documents cgroup v1 as deprecated starting in Kubernetes 1.35 and says kubelet no longer starts on a cgroup-v1 node by default. An administrator can temporarily set failCgroupV1: false as a fallback for a v1 node, but that is not a cgroup-v2 fix. Plan the migration to a supported v2 environment instead, and qualify any behavior by the Kubernetes release running in your cluster.
Choose the repair based on these decision points
| Observed situation | Most appropriate next action | Why |
|---|---|---|
| Kubelet will not start and the node is NotReady | Verify cgroup mode, kernel version, kubelet configuration, and service overrides | The failure occurs before the runtime can create a Pod. |
FailedCreatePodSandbox after enabling v2 |
Align kubelet and runtime drivers, verify runtime support, then recreate Pods on a clean node | Sandbox creation depends on both managers agreeing on the hierarchy. |
| New node works but an old node fails after a driver edit | Cordon, drain, and replace the old node when possible | Existing sandboxes may retain old-driver semantics. |
| Container starts and is OOM-killed | Check application cgroup-v2 support and memory sizing | The runtime succeeded; process sizing is now the relevant layer. |
| Rootless kind workload fails with resource-limit errors | Check PID and inotify limits in the rootless environment | Those host limits can block workloads independently of cgroup-driver alignment. |
| Runtime may support CRI driver discovery | Verify release, feature-gate, and runtime support before removing explicit settings | Discovery is version-sensitive and is not automatically active everywhere. |
Common mistakes that prolong the outage
- Checking only one node: a mixed cgroup hierarchy can make the problem appear intermittent.
- Assuming detection equals compatibility: kubelet can detect v2 while the runtime, package, or agent is too old.
- Using
cgroupfson a systemd-managed node: two managers can create unstable resource hierarchies. - Editing the wrong containerd table: the plugin path differs between containerd 1.x and 2.x.
- Restarting kubelet as the whole migration plan: existing Pod sandboxes may not be recreated under the new driver.
- Treating an OOM kill as sandbox failure: inspect whether the container reached a running state first.
- Removing explicit configuration prematurely: CRI driver discovery is dependent on installed versions and feature support.
What a successful repair looks like
On each repaired node, stat -fc %T /sys/fs/cgroup/ returns cgroup2fs; the kernel and runtime meet the release-specific support requirements; kubelet and the runtime use the same driver; and the runtime’s CRI integration is active. A newly created test Pod reaches a running or completed state without sandbox errors. Only after that should you evaluate application memory behavior, sidecar agents, and workload-specific limits.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
