<blockquote>
<p>which deploys containers based on Distroless</p>
</blockquote>
<p>Using Distroless is a good practice! This typically means that you don't have more than the absolute minimum in your container to run your application - it is typically just your application and some necessary libraries. This also means that there are no extra tools and debugging possibilities within the container - which is good in a production environment for security and maintainability reasons.</p>
<blockquote>
<p>This means, I cannot open a shell on these containers, like I normally would for debugging</p>
</blockquote>
<p>To be able to use debugging or other tools in a container based on Distroless, you can build the same container with e.g. Ubuntu as base image. To be able to do this, you typically need the <code>Dockerfile</code>, so that you can change how the container is built.</p>

CC BY-SA 4.0
2021-08-28T15:13:00.707Z
2021-08-29T07:37:33.167Z
2021-08-29T07:37:33.167Z
Jonas
<p>I am using a helm chart, which deploys containers based on <a href="https://github.com/GoogleContainerTools/distroless" rel="nofollow noreferrer">Distroless</a>.
This means, I cannot open a shell on these containers, like I normally would for debugging, since Distroless containers seem to have no shell command.</p>
<pre><code>$ kubectl exec --stdin --tty $POD -n $NAMESPACE -- /bin/sh
error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec &quot;ded18296c4c0008c29a165ac761f73e3bbabcb068936b4b6efd2bcd686aa8930&quot;: OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: &quot;/bin/sh&quot;: stat /bin/sh: no such file or directory: unknown
</code></pre>
<p>I also tried using the <code>kubectl debug</code> command, but get the following error:</p>
<pre><code>$ kubectl debug -it $POD -n $NAMESPACE --image alpine    
error: ephemeral containers are disabled for this cluster (error from server: &quot;the server could not find the requested resource&quot;)
</code></pre>
<p>This is on an Azure Kubernetes cluster, and I could not find an option to enable &quot;ephemeral containers&quot;.</p>
<p>For debugging, I would like to read a log file that is written by the container, but not exposed to standard output.
How can I do this in Kubernetes?</p>

<kubernetes><azure-kubernetes-service>
Read disk of distroless container in Kubernetes for debugging
Peter Zeller
# Read disk of distroless container in Kubernetes for debugging

(Asked by: username_0 on 2021-08-27)

I am using a helm chart, which deploys containers based on Distroless.
This means, I cannot open a shell on these containers, like I normally would for debugging, since Distroless containers seem to have no shell command.
$ kubectl exec --stdin --tty $POD -n $NAMESPACE -- /bin/sh
error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "ded18296c4c0008c29a165ac761f73e3bbabcb068936b4b6efd2bcd686aa8930": OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "/bin/sh": stat /bin/sh: no such file or directory: unknown

I also tried using the kubectl debug command, but get the following error:
$ kubectl debug -it $POD -n $NAMESPACE --image alpine    
error: ephemeral containers are disabled for this cluster (error from server: "the server could not find the requested resource")

This is on an Azure Kubernetes cluster, and I could not find an option to enable "ephemeral containers".
For debugging, I would like to read a log file that is written by the container, but not exposed to standard output.
How can I do this in Kubernetes?

**Tags:** kubernetes, azure-kubernetes-service


---

## 1 answers

### Answer by username_1 on 2021-08-28. Score: 1

> which deploys containers based on Distroless

Using Distroless is a good practice! This typically means that you don't have more than the absolute minimum in your container to run your application - it is typically just your application and some necessary libraries. This also means that there are no extra tools and debugging possibilities within the container - which is good in a production environment for security and maintainability reasons.

> This means, I cannot open a shell on these containers, like I normally would for debugging

To be able to use debugging or other tools in a container based on Distroless, you can build the same container with e.g. Ubuntu as base image. To be able to do this, you typically need the `Dockerfile`, so that you can change how the container is built.


---

