A distroless payment container has no shell, so kubectl exec ... -- sh fails. The developer still needs tools inside the Pod’s network namespace for debugging. What is the appropriate approach?
Select an answer to reveal the explanation.
Short Explanation
Distroless images are locked showrooms—no shell under the counter. kubectl debug rolls in a toolbox ephemeral container beside the app. That is the supported way to poke around without rebuilding a fat image first.
Full Explanation
Distroless and similar minimal images often omit a shell, so exec fails. kubectl debug can add an ephemeral container (toolbox image) that shares process/network namespaces with the target Pod for troubleshooting. Privileged flags, restartPolicy, and Service annotations do not magically inject a shell into an existing image.