Troubleshooting·Certified Kubernetes Application Developer
Debugging a Container Without a Shell
Minimal and distroless images have no shell, so `kubectl exec` fails and the standard debugging routine stops at step one. `kubectl debug` adds an ephemeral container to the running Pod - sharing its network namespace, so it sees the same IP and can reach the same things - without restarting anything. The `--copy-to` variant covers the case where the Pod will not stay up long enough.
Observability and Maintenance Guide 42 of 44 Intermediate
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 15 min
- Reviewed23 August 2026
Written against the versions above. An ephemeral container cannot be removed once added. It stays in the Pod's spec until the Pod is deleted, which is a reason to prefer `--copy-to` on anything running in production - it leaves the original untouched.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A cluster on 1.25 or newer, where ephemeral containers are stable.
- The session creates namespace
ckad-dbgand a Pod runningregistry.k8s.io/pause:3.10, then attaches a busybox ephemeral container and makes a debug copy.
-
A container with no shell
-
Attach a container that does have one
-
What it did to the Pod
-
A copy with a different command