From 17dc7c7e2feef495b6819c19448285c7dd5005cc Mon Sep 17 00:00:00 2001 From: Mark Rossetti Date: Thu, 19 May 2022 14:46:01 -0700 Subject: [PATCH] Add troubleshooting tips for hostprocess containers 'failed to create user process token' error during container creation Signed-off-by: Mark Rossetti --- .../configure-pod-container/create-hostprocess-pod.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index a7dcbafd34..ed5506c45b 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -214,3 +214,10 @@ container, aiming to limit the degree of privileges so as to avoid accidental (o malicious) damage to the host. The LocalSystem service account has the highest level of privilege of the three and should be used only if absolutely necessary. Where possible, use the LocalService service account as it is the least privileged of the three options. + +## Troubleshooting HostProcess containers + +- HostProcess containers fail to start with `failed to create user process token: failed to logon user: Access is denied.: unknown` + + Ensure containerd is running as `LocalSystem` or `LocalService` service accounts. User accounts (even Administrator accounts) do not have permissions to create logon tokens for any of the supported [user accounts](#choosing-a-user-account). + \ No newline at end of file