Debugging a Container Without a Shell

Observability and Maintenance / Guide 42 of 44 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 15 min

An ephemeral container cannot be removed once added. It stays in the Pod's spec until the Pod is deleted, which is a reason to prefer --copy-to on anything running in production - it leaves the original untouched.

This guide includes

Use this when kubectl exec fails because the image contains no shell. This matters because minimal and distroless images are increasingly normal, and the answer is to bring a shell alongside rather than put one into the image.

• meeting an image that is a single static binary with no shell in it at all
• attaching a busybox ephemeral container with kubectl debug --target
• seeing what that did to the Pod - and that it cannot be undone
• making a copy with a different command, for when the Pod crashes too fast to attach to

Before you start

• A cluster on 1.25 or newer, where ephemeral containers are stable.
• The session creates namespace ckad-dbg and a Pod running registry.k8s.io/pause:3.10, then attaches a busybox ephemeral container and makes a debug copy.

1. 1

   A container with no shell

2. 2

   Attach a container that does have one

3. 3

   What it did to the Pod

4. 4

   A copy with a different command

Official sources

• Debug Running Pods
• Ephemeral Containers
• kubectl debug