kubectl execRun a command or shell inside a running container
kubectl exec runs a command in a container that is already running, like docker exec but through the Kubernetes API. Use it to check config, environment and connectivity from the pod's point of view, or open an interactive shell with -it.
kubectl exec [-it] (POD | TYPE/NAME) [-c CONTAINER] [-n NAMESPACE] -- COMMAND [ARGS...]The api can't reach its database. See which settings and DNS the running container actually has, without opening a shell.
kubectlThe Kubernetes CLI.
kubectl sends a POST to the pod's exec subresource, /api/v1/namespaces/prod/pods/NAME/exec?command=sh&stdin=true&tty=true&container=api, and upgrades the connection to a streaming protocol (WebSocket in current versions, SPDY before 1.31). The API server checks RBAC for create on pods/exec, then proxies the stream to the kubelet on the pod's node. The kubelet asks the container runtime (containerd, via CRI) to start a new process inside the container's existing namespaces and cgroup: same filesystem, network, user and limits as the app. Your keystrokes and its output flow back over that one connection. When the command exits, kubectl exits with the same code. Nothing about the pod spec changes, and anything you change inside the container is lost when it restarts.
One upgraded HTTPS stream from your laptop, through the API server and the node's kubelet, into a new process inside the container.
kubectl reads your kubeconfig and sends POST /api/v1/namespaces/prod/pods/NAME/exec with command=sh, stdin and tty, asking to upgrade to a streaming (WebSocket) connection.
-i, --stdinPass your stdin to the process (needed for pipes and shells)-t, --ttyAllocate a terminal (prompts, colours, Ctrl+C)-c NAMEContainer to run in-n NSNamespace of the pod--End of kubectl flags; the rest is the container commanddeploy/NAMEExec into one pod of a Deployment-q, --quietOnly print the remote command's outputkubectl exec pod ls -la /appWithout -- kubectl treats -la as its own flags; current versions reject the form altogether.
kubectl exec pod -- ls -la /appHot-fixing a config file inside a container with exec and viThe change is lost on the next restart and other replicas never get it; the pod now differs from Git.
Change the ConfigMap or image, then kubectl rollout restart deploy/NAMEkubectl exec -it pod -- sh | tee out.txt-t with a pipe mixes carriage returns into the output and some commands behave differently on a TTY.
kubectl exec pod -- sh -c 'cmd' > out.txt # no -t when capturing outputGranting developers pods/exec in prod 'just for debugging'exec is a shell with the pod's service-account token, secrets and network access: effectively full access to that workload.
Give exec only where needed, audit it, and prefer kubectl debug or logsTry these on a Linux machine of your own. Each task has a hint and a solution.
Write the command that prints the environment variables of the container sidecar in pod web-5c7b9d6f4-q2x7z (namespace shop).
Write a command that tests from inside pod api-7f9c5d4b6-2xkqp (namespace prod) whether the Service redis answers on port 6379, without opening a shell.
Read this error and say what to run instead: 'exec: "bash": executable file not found in $PATH'
Compare /etc/resolv.conf on the practice machine with the one inside pod api-7f9c5d4b6-2xkqp (namespace prod): note the nameserver, the search domains and ndots.
kubectl execRun a command or shell inside a running container
kubectl exec runs a command in a container that is already running, like docker exec but through the Kubernetes API. Use it to check config, environment and connectivity from the pod's point of view, or open an interactive shell with -it.
kubectl exec [-it] (POD | TYPE/NAME) [-c CONTAINER] [-n NAMESPACE] -- COMMAND [ARGS...]The api can't reach its database. See which settings and DNS the running container actually has, without opening a shell.
kubectlThe Kubernetes CLI.
kubectl sends a POST to the pod's exec subresource, /api/v1/namespaces/prod/pods/NAME/exec?command=sh&stdin=true&tty=true&container=api, and upgrades the connection to a streaming protocol (WebSocket in current versions, SPDY before 1.31). The API server checks RBAC for create on pods/exec, then proxies the stream to the kubelet on the pod's node. The kubelet asks the container runtime (containerd, via CRI) to start a new process inside the container's existing namespaces and cgroup: same filesystem, network, user and limits as the app. Your keystrokes and its output flow back over that one connection. When the command exits, kubectl exits with the same code. Nothing about the pod spec changes, and anything you change inside the container is lost when it restarts.
One upgraded HTTPS stream from your laptop, through the API server and the node's kubelet, into a new process inside the container.
kubectl reads your kubeconfig and sends POST /api/v1/namespaces/prod/pods/NAME/exec with command=sh, stdin and tty, asking to upgrade to a streaming (WebSocket) connection.
-i, --stdinPass your stdin to the process (needed for pipes and shells)-t, --ttyAllocate a terminal (prompts, colours, Ctrl+C)-c NAMEContainer to run in-n NSNamespace of the pod--End of kubectl flags; the rest is the container commanddeploy/NAMEExec into one pod of a Deployment-q, --quietOnly print the remote command's outputkubectl exec pod ls -la /appWithout -- kubectl treats -la as its own flags; current versions reject the form altogether.
kubectl exec pod -- ls -la /appHot-fixing a config file inside a container with exec and viThe change is lost on the next restart and other replicas never get it; the pod now differs from Git.
Change the ConfigMap or image, then kubectl rollout restart deploy/NAMEkubectl exec -it pod -- sh | tee out.txt-t with a pipe mixes carriage returns into the output and some commands behave differently on a TTY.
kubectl exec pod -- sh -c 'cmd' > out.txt # no -t when capturing outputGranting developers pods/exec in prod 'just for debugging'exec is a shell with the pod's service-account token, secrets and network access: effectively full access to that workload.
Give exec only where needed, audit it, and prefer kubectl debug or logsTry these on a Linux machine of your own. Each task has a hint and a solution.
Write the command that prints the environment variables of the container sidecar in pod web-5c7b9d6f4-q2x7z (namespace shop).
Write a command that tests from inside pod api-7f9c5d4b6-2xkqp (namespace prod) whether the Service redis answers on port 6379, without opening a shell.
Read this error and say what to run instead: 'exec: "bash": executable file not found in $PATH'
Compare /etc/resolv.conf on the practice machine with the one inside pod api-7f9c5d4b6-2xkqp (namespace prod): note the nameserver, the search domains and ndots.