Is kubectl debug dangerous?

LOW risk. Adds temporary containers to live pods.

kubectl debug

Q: What does kubectl debug do?

Debug pods and nodes by attaching ephemeral containers. kubectl debug creates ephemeral debug containers in running pods (K8s 1.23+), copies pods with different images, or attaches a shell to a node. The solution to debugging distroless/scratch images that have no shell or tools.

Debug pods and nodes by attaching ephemeral containers.

low risk

interactive breakdown — edit the command and press Explain

What it does

kubectl debug creates ephemeral debug containers in running pods (K8s 1.23+), copies pods with different images, or attaches a shell to a node. The solution to debugging distroless/scratch images that have no shell or tools.

Common flags

Flag	Meaning
`-it`	Interactive terminal
`--image`	Debug container image
`--copy-to`	Create a debug copy of the pod
`--target`	Target container to share process namespace with

Examples

kubectl debug -it mypod --image=busybox --target=mycontainerAdd busybox debug container sharing target's process namespace · explain & risk-check →

kubectl debug node/mynode -it --image=ubuntuDebug a cluster node with ubuntu container · explain & risk-check →

kubectl debug -it mypod --copy-to=mypod-debug --image=ubuntu -- bashCreate a debuggable copy of a pod · explain & risk-check →

Pro tip

Use `kubectl debug` with `--image=nicolaka/netshoot` — the netshoot image has tcpdump, curl, dig, ss, and 50+ network tools pre-installed, perfect for K8s network debugging.

kubectl exec kubectl logs kubectl describe

Open the full explainer →More in Kubernetes & Helm

Reference text is hand-written and may be incomplete — check man kubectl for your version. Test destructive commands on a non-production system first.