Read only container error attempting to create a contact group

Without exception, every single code example/tutorial for adding a contact group uses a nil container value i.e. the toContainerWithIdentifier parameter is nil, as below. I've not been able to find an example usage where it isn't nil.

        let group = CNMutableGroup()
        group.name = "whatever"
        let saveRequest = CNSaveRequest()
        saveRequest.add(group, toContainerWithIdentifier: nil)
        do {
            try store.execute(saveRequest)
        } catch {
             handle error
        }

I've been running this code and 99.9% of the time it works as expected. However on one handset the catch is being executed with

Error Domain=CNErrorDomain Code=207 "Container is read-only"

How should I deal with this? How can I find out what container it is being added to? Why would it be read only? If nil means add to the default container, why is the default container in this case read only?

How can I change the code that it will always run on every device? I've not been able to find any examples/tutorials for creating a custom container to which the group can be added.