I am using a helm chart, which deploys containers based on Distroless. This means, I cannot open a shell on these containers, like I normally would for debugging, since Distroless containers seem to have no shell command.

$ kubectl exec --stdin --tty $POD -n $NAMESPACE -- /bin/sh
error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "ded18296c4c0008c29a165ac761f73e3bbabcb068936b4b6efd2bcd686aa8930": OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "/bin/sh": stat /bin/sh: no such file or directory: unknown

I also tried using the kubectl debug command, but get the following error:

$ kubectl debug -it $POD -n $NAMESPACE --image alpine    
error: ephemeral containers are disabled for this cluster (error from server: "the server could not find the requested resource")

This is on an Azure Kubernetes cluster, and I could not find an option to enable "ephemeral containers".

For debugging, I would like to read a log file that is written by the container, but not exposed to standard output. How can I do this in Kubernetes?

1 Answer 1


which deploys containers based on Distroless

Using Distroless is a good practice! This typically means that you don't have more than the absolute minimum in your container to run your application - it is typically just your application and some necessary libraries. This also means that there are no extra tools and debugging possibilities within the container - which is good in a production environment for security and maintainability reasons.

This means, I cannot open a shell on these containers, like I normally would for debugging

To be able to use debugging or other tools in a container based on Distroless, you can build the same container with e.g. Ubuntu as base image. To be able to do this, you typically need the Dockerfile, so that you can change how the container is built.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.