kx debug
Attaches a container carrying its own shell to a running pod, which is how to get inside an image that has none — distroless or scratch, where kx exec can only report that it found no shell. The pod is not restarted and what it runs is unchanged.
The image comes from the debug_image config key (busybox unless set); --image overrides it for one run. The container shares the process namespace of the pod’s container when there is only one, so its filesystem is reachable at /proc/1/root; name one with --target when the pod has several.
Kubernetes keeps an ephemeral container on the pod’s spec for as long as the pod lives — there is no removing one, only replacing the pod.
A Node index — from kx get nodes or kx top nodes — debugs the node instead, which is a different operation wearing the same name: kubectl creates a new privileged pod on that node, in the current namespace, with the host’s filesystem mounted at /host and the host namespaces joined. Use it to reach a kubelet, a container runtime, or the node’s own logs. That pod outlives the shell — kubectl names it on exit, and it is yours to delete. --target does not apply, since there is no container to share a namespace with.
Unrecognized flags are passed through to kubectl.
Usage
kx debug [OPTIONS] <index> [kubectl flags] [-- command...]Arguments
| Argument | Description |
|---|---|
<index> | Row number from the current listing; run kx state to see it |
[command]... | Command to run in the pod instead of a shell |
Options
| Option | Description |
|---|---|
--image string | Image for the debug container (default: the debug_image config key) |
--target string | Container to share a process namespace with, for a pod with several; not for nodes |
Global options
| Option | Description |
|---|---|
--no-color | Disable styled output |
-h, --help | Show this message and exit |
Examples
kx debug 1
kx debug 1 --image alpine
kx debug 1 -- ls /proc/1/root
kx debug 1 -- ls /host/var/log