DevOps error reference

Fix CrashLoopBackOff: run kubectl logs --previous and kubectl describe pod, then match the exit code to the cause. Covers OOMKilled, bad config and probes.

payments-api-7d4f-x8k2 0/1 CrashLoopBackOff 6 8m

Fix ImagePullBackOff: run kubectl describe pod, then correct the image name or tag, add imagePullSecrets or fix registry access. Covers rate limits and TLS.

payments-api-7d4f-x8k2 0/1 ImagePullBackOff 0 2m

Fix OOMKilled exit code 137: run kubectl describe pod to confirm, then raise the memory limit or fix the leak. Covers JVM and Node heap settings and sizing.

Last State: Terminated

Fix a Pod stuck in Pending: run kubectl describe pod and read FailedScheduling. Fix Insufficient cpu, taints, volume conflicts, PVC binding and node selectors.

Warning FailedScheduling default-scheduler

Fix a Service with no endpoints: run kubectl get endpointslices, then match the selector to Pod labels and make the Pods Ready. Covers port mismatches.

curl: (7) Failed to connect to payments-api port 80: Connection refused

Fix CreateContainerConfigError: run kubectl describe pod and read the Events. Usually a missing Secret, ConfigMap, key or ServiceAccount the Pod references.

payments-api-7d4f-x8k2 0/1 CreateContainerConfigError 0 2m

Fix a NotReady node: run kubectl describe node, then check disk and memory pressure, the kubelet, container runtime and CNI. Includes journalctl commands.

ip-10-0-1-42 NotReady <none> 14d v1.31.3

Fix a PVC stuck in Pending: run kubectl describe pvc, then add the CSI driver, set a valid StorageClass, fix zone or access mode. Covers WaitForFirstConsumer.

data-pvc Pending gp3 8m

Fix "connection to the server localhost:8080 was refused": check KUBECONFIG, then kubectl config get-contexts and use-context. Covers no kubeconfig and sudo.

The connection to the server localhost:8080 was refused - did you specify the right host or port?

Fix "0/3 nodes are available: node(s) had untolerated taint": run kubectl describe node, then add a toleration or remove the taint. Covers control-plane nodes.

0/3 nodes are available: 3 node(s) had untolerated taint {node-role.kubernetes.io/control-plane: }. preemption: 0/3 nodes are available: 3 Preemption is not helpful for scheduling.

Fix "Readiness probe failed: HTTP probe failed": curl the endpoint inside the Pod, correct the port and path, then raise initialDelaySeconds or timeoutSeconds.

Readiness probe failed: HTTP probe failed with statuscode: 503

Fix "no matches for kind in version": run kubectl api-resources, then update the removed apiVersion or install the missing CRD first. Covers Helm and CI order.

error: unable to recognize "app.yaml": no matches for kind "Ingress" in version "extensions/v1beta1"

Fix "Unable to attach or mount volumes": check Multi-Attach on a ReadWriteOnce volume, a zone mismatch or a stale attachment. Covers CSI drivers and limits.

Unable to attach or mount volumes: unmounted volumes=[data], unattached volumes=[data kube-api-access-x7k2q]: timed out waiting for the condition

Fix Pod eviction for ephemeral-storage: set requests and limits, cap emptyDir with sizeLimit, rotate container logs and tune image garbage collection.

Pod ephemeral local storage usage exceeds the total limit of containers 1Gi

Fix "Forbidden: User cannot list resource": confirm with kubectl auth can-i, then add a Role and RoleBinding for the exact verb and apiGroup, not cluster-admin.

Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:default:api" cannot list resource "pods" in API group "" in the namespace "production"

Fix Init:CrashLoopBackOff: run kubectl logs pod -c init-name, then check the dependency it waits on, migrations that cannot rerun, and volume permissions.

Init:CrashLoopBackOff

Fix Kubernetes "context deadline exceeded": find which component timed out, then check admission webhooks, API server and etcd, CSI calls, probes and kubectl.

Internal error occurred: failed calling webhook "vpolicy.kb.io": Post "https://webhook-service.default.svc:443/validate?timeout=10s": context deadline exceeded

Fix "is not authorized to perform": run aws sts get-caller-identity, then simulate the action in IAM. Covers SCPs, boundaries, resource policies and AssumeRole.

An error occurred (AccessDenied) when calling the PutObject operation:

Fix S3 AccessDenied on GetObject: run aws sts get-caller-identity, then the IAM policy simulator. Covers bucket policy, Block Public Access and ARN mistakes.

An error occurred (AccessDenied) when calling the GetObject operation: Access Denied

Fix ExpiredToken: run aws sts get-caller-identity, then refresh with aws sso login or assume the role again. Covers stale env vars, session length and CI OIDC.

An error occurred (ExpiredToken) when calling the ListBuckets operation: The provided token has expired.

Fix ThrottlingException "Rate exceeded": set AWS_RETRY_MODE=adaptive, cut API calls, and request a quota increase. Covers Terraform parallelism and DynamoDB.

An error occurred (ThrottlingException) when calling the DescribeInstances operation (reached max retries: 4): Rate exceeded

Fix ECS CannotPullContainerError: add a NAT or VPC endpoints, grant the execution role ECR access, and check the image tag. Covers Fargate and secrets errors.

CannotPullContainerError: pull image manifest has been retried 5 time(s): failed to resolve ref "123456789012.dkr.ecr.eu-west-1.amazonaws.com/api:1.4.2": failed to do request: Head "https://...": dial tcp 10.0.2.15:443: i/o timeout

Fix ALB 502 Bad Gateway: turn on access logs, then raise the target's keep-alive above the ALB idle timeout. Also covers health checks and security groups.

elb_status_code=502 target_status_code=- error_reason=-

Fix Lambda "Task timed out": read the REPORT line, raise memory and timeout, and check VPC NAT access. Covers cold starts and in-function client timeouts.

{"errorMessage":"2026-09-21T09:14:02.123Z abc-123 Task timed out after 30.05 seconds"}

Fix iam:PassRole denied: add iam:PassRole on the exact role ARN with an iam:PassedToService condition. Covers EC2 instance profiles and ECS task roles.

An error occurred (AccessDenied) when calling the RunInstances operation: User: arn:aws:iam::123456789012:user/dev is not authorized to perform: iam:PassRole on resource: arn:aws:iam::123456789012:role/app-instance-role

Fix InsufficientInstanceCapacity: retry in another availability zone, switch instance type, or accept a range of types. Covers Spot and Capacity Reservations.

An error occurred (InsufficientInstanceCapacity) when calling the RunInstances operation: We currently do not have sufficient m5.large capacity in the Availability Zone you requested (eu-west-1a). Our system will be working on provisioning additional capacity.

Fix EKS "You must be logged in to the server (Unauthorized)": run aws sts get-caller-identity, then add an access entry or aws-auth mapping. Covers lockouts.

error: You must be logged in to the server (Unauthorized)

Fix EKS nodes not joining: attach the node IAM policies, open the API server path, check security groups and subnet tags, then read the instance bootstrap logs.

NodeCreationFailure: Instances failed to join the kubernetes cluster

Fix ECS "unable to place a task": read the closest-match reason, free the host port, add memory or CPU, or use a capacity provider. Covers ENI limits in awsvpc.

service api was unable to place a task because no container instance met all of its requirements. The closest matching container-instance 8f2a1c has insufficient memory available.

Fix S3 SignatureDoesNotMatch: sync the system clock, strip whitespace from the secret key, and set the right region. Also covers proxies and presigned URLs.

An error occurred (SignatureDoesNotMatch) when calling the ListObjectsV2 operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.

Fix "Cannot connect to the Docker daemon": run sudo systemctl start docker and sudo usermod -aG docker $USER. Covers contexts, Docker Desktop, WSL and CI.

Cannot connect to the Docker daemon at unix:///var/run/docker.sock.

Fix Docker "no space left on device": run docker system df, then docker system prune and docker builder prune. Covers container logs, volumes and Desktop.

ERROR: failed to solve: failed to register layer:

Fix "exec format error": check the image with docker inspect, then run docker buildx build --platform linux/amd64. Covers multi-arch images and CI.

standard_init_linux.go:228: exec user process caused: exec format error

Fix "port is already allocated": run docker ps and lsof -i :PORT to find the owner, then stop it or change the host port. Covers Compose and localhost binds.

docker: Error response from daemon: driver failed programming external

Fix Docker Hub "toomanyrequests: You have reached your pull rate limit": run docker login, or pull via an ECR pull-through cache or a registry mirror.

Error response from daemon: toomanyrequests: You have reached your pull rate

Fix "pull access denied, repository does not exist": check the image name, then docker login to the right registry. Covers token scopes, Actions and Kubernetes.

Error response from daemon: pull access denied for myapp, repository does not exist or may require 'docker login': denied: requested access to the resource is denied

Fix "executable file not found in $PATH": run docker run --rm -it --entrypoint sh image, then fix the COPY path, exec-form CMD or missing shell.

OCI runtime create failed: container_linux.go:380: starting container process caused: exec: "myapp": executable file not found in $PATH: unknown

Fix "container name is already in use": run docker ps -a, then docker rm or docker rename the old container. Covers docker run --rm and Compose in CI.

docker: Error response from daemon: Conflict. The container name "/postgres" is already in use by container "3f2c1a9e4b7d". You have to remove (or rename) that container to be able to reuse that name.

Fix "failed to solve: process did not complete successfully: exit code 1": rebuild with --progress=plain and debug the failing RUN layer interactively.

ERROR: failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1

Fix "docker-credential-desktop not installed": remove credsStore from ~/.docker/config.json or install a helper. Covers CI and the Kubernetes variant.

error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``

Fix Compose "connection refused" at startup: add a healthcheck and depends_on with condition: service_healthy. Also covers migration gates and app retries.

dial tcp 172.18.0.3:5432: connect: connection refused

Fix "Error acquiring the state lock": read the lock info, wait if a run is live, otherwise run terraform force-unlock LOCK_ID. Covers S3 and DynamoDB backends.

Error: Error acquiring the state lock

Fix "Invalid for_each argument": build the map keys from known inputs instead of values only known after apply. Covers data sources, modules and -target.

Error: Invalid for_each argument

Fix "Inconsistent dependency lock file": run terraform init, or terraform providers lock for every platform. In CI, use -lockfile=readonly instead of -upgrade.

Error: Inconsistent dependency lock file

Fix "Provider configuration not present": restore the provider block and run terraform destroy, or use terraform state rm. Covers aliased providers in modules.

Error: Provider configuration not present

Fix Terraform "Error: Cycle": run terraform graph to see it, then break the loop with separate security group rules, remove depends_on, or split modules.

Error: Cycle: aws_security_group.app, aws_security_group.db

Fix Terraform "resource already exists": run terraform import to adopt the object, or rename yours. Always plan after importing. Covers state drift.

Error: creating S3 Bucket (acme-assets): BucketAlreadyOwnedByYou: Your previous request to create the named bucket succeeded and you already own it

Fix Terraform "Saved plan is stale": run terraform plan -out again, then apply that fresh plan. Use state locking so state cannot move between plan and apply.

Error: Saved plan is stale

Fix Terraform "Backend configuration changed": run terraform init -migrate-state to move state, or init -reconfigure to discard the old setup. Safe CI defaults.

Error: Backend configuration changed

Fix "Invalid count argument": derive count from input variables, not resources created in the same run. Or switch to for_each, or apply with -target first.

Error: Invalid count argument

Fix Terraform "Unsupported argument": check the provider docs for your version, convert arguments to blocks, rename module inputs. Then run terraform validate.

Error: Unsupported argument

Fix "Permission denied (publickey)": run ssh -vT git@github.com, ssh-add your key, chmod 600 it, and add the public key to your account. Covers multiple keys.

git@github.com: Permission denied (publickey).

Fix "rejected non-fast-forward": run git pull --rebase then git push. Use --force-with-lease only to overwrite on purpose, and recover lost commits via reflog.

! [rejected] main -> main (non-fast-forward)

Fix "refusing to merge unrelated histories": confirm with git log, then git pull --allow-unrelated-histories or rebase. Explains what the flag does.

fatal: refusing to merge unrelated histories

Fix "Your local changes would be overwritten by merge": run git stash, pull, then git stash pop. Or commit first, or discard with git restore. Pick by intent.

error: Your local changes to the following files would be overwritten by merge:

Fix Git "Authentication failed" on GitHub: use a personal access token instead of a password, clear the stale keychain entry, or switch the remote to SSH.

fatal: Authentication failed for 'https://github.com/acme/myapp.git/'

Fix "fatal: not a git repository" fast: check pwd, run git rev-parse --show-toplevel, then git init or re-clone. Covers safe.directory, submodules and Docker.

fatal: not a git repository (or any of the parent directories): .git

Fix a Git merge conflict: run git status, edit the conflict markers, git add the file, then git commit. Use git merge --abort to start over, or checkout --ours.

Automatic merge failed; fix conflicts and then commit the result.

Fix "src refspec main does not match any": make a first commit, or rename master with git branch -M main, then git push -u origin main. Covers typos and CI.

error: src refspec main does not match any

Fix detached HEAD: run git switch -c new-branch to keep your commits, or git switch main to leave. Covers recovering via reflog and why CI is detached.

Warning: you are leaving 1 commit behind, not connected to any of your branches

Fix GitLab "job is stuck, no active runners": match job tags to the runner, allow protected branches, and check the runner is online. Covers shared runners.

This job is stuck because you don't have any active runners online or available with any of these tags assigned to them: docker

Fix "could not read Username for gitlab.com" in CI: set git config insteadOf with CI_JOB_TOKEN, allow the job token, or use a deploy key over SSH.

fatal: could not read Username for 'https://gitlab.com': No such device or address

Fix "Resource not accessible by integration": add the missing scope to the permissions block, such as contents: write or pull-requests: write. Covers forks.

RequestError [HttpError]: Resource not accessible by integration

Fix "Not authorized to perform sts:AssumeRoleWithWebIdentity": add id-token: write, print the OIDC claims, and match the trust policy sub and aud exactly.

Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity

Fix "No space left on device" on a CI runner: remove unused toolchains, run docker system prune, and trim caches. Covers self-hosted runners and larger runners.

failed to register layer: write /usr/lib/...: no space left on device

Fix a GitHub Actions workflow that will not trigger: validate the YAML, check branch and path filters and the default branch. Covers GITHUB_TOKEN and cron.

(no error: the workflow simply does not appear in the Actions tab)

Fix "Cannot connect to the Docker daemon" in CI: add a docker:dind service with DOCKER_HOST, bind the socket, or build with Kaniko or Buildah instead.

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Fix "Unable to download artifact: Artifact not found": match the upload and download names, order jobs with needs, and handle the v4 changes. Covers expiry.

Error: Unable to download artifact(s): Artifact not found for name: build-output

Fix "Too many open files": check the limit in /proc/PID/limits, find the leak with lsof, then raise LimitNOFILE in systemd. Covers Docker and Kubernetes.

OSError: [Errno 24] Too many open files

Fix "bind: address already in use": run ss -ltnp or lsof -i :PORT to find the listener, then stop it. For TIME_WAIT, set SO_REUSEADDR. Covers IPv6 overlap.

bind: address already in use

Fix "No space left on device" with free space: run df -i for inodes and lsof +L1 for deleted open files. Covers wrong filesystems and finding the space with du.

cp: cannot create regular file '/var/log/app.log': No space left on device

Fix "Read-only file system": run mount | grep ' ro', check dmesg for I/O errors, then mount -o remount,rw. Covers fsck, containers and cloud volumes.

touch: cannot touch '/var/log/app.log': Read-only file system

Fix "fork: Cannot allocate memory": run free -m, count threads, then check cgroup limits, ulimit -u and vm.overcommit_memory. Often not real memory exhaustion.

bash: fork: Cannot allocate memory

Fix "sudo: unable to resolve host": add your hostname to /etc/hosts as 127.0.1.1 myserver, or set it with hostnamectl. Covers containers and cloud images.

sudo: unable to resolve host myserver: Name or service not known

Fix "Could not get lock dpkg/lock-frontend": run ps aux | grep apt, wait for unattended-upgrades, then dpkg --configure -a. Do not delete the lock file.

E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

Fix "Temporary failure in name resolution": check /etc/resolv.conf, test with dig @8.8.8.8, and restart systemd-resolved. Covers containers and search domains.

socket.gaierror: [Errno -3] Temporary failure in name resolution

Fix Helm UPGRADE FAILED: run helm status and helm history, then helm rollback the pending release. Covers immutable fields, CRDs and using --atomic.

Error: UPGRADE FAILED: another operation (install/upgrade/rollback)

Fix Helm "cannot re-use a name": run helm list -A --all, then use helm upgrade --install, or helm uninstall the failed release. Covers other namespaces.

Error: INSTALLATION FAILED: cannot re-use a name that is still in use

Fix Helm "rendered manifests contain a resource that already exists": add Helm ownership labels and annotations to adopt it, or delete it. Covers CRDs.

Error: INSTALLATION FAILED: Unable to continue with install: ConfigMap "app-config" in namespace "production" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"

Fix Helm "another operation is in progress": run helm history, then helm rollback to the last good revision. Last resort: delete the pending release Secret.

Error: UPGRADE FAILED: another operation (install/upgrade/rollback) is in progress

Fix Helm "nil pointer evaluating interface {}": run helm template --debug, then add default, required or an if guard for the missing value. Add a values schema.

Error: INSTALLATION FAILED: template: api/templates/deployment.yaml:23:24: executing "api/templates/deployment.yaml" at <.Values.image.tag>: nil pointer evaluating interface {}.tag