5 ms·
You can run a small sidecar with a shell and if you enable shared process namespace you can access the filesystem of the main "distroless" container via /proc (
by ithkuil 5y ago
You can run a small sidecar with a shell and if you enable shared process namespace you can access the filesystem of the main "distroless" container via /proc (e.g. /proc/123/root)
- BossingAround 5y agoI think the difficulty arises in the fact that you can't spawn the sidecar without terminating a pod, as far as I know. So you either create a sidecar for every pod, "just in case", or you have to restart your pod for debugging purposes (and modify your YAML files). That is, if we're talking Kubernetes of course.
- ithkuil 5y agoThere is an alpha feature: https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/ https://kubernetes.io/docs/concepts/workloads/pods/ephemeral... Otherwise you have to prepare in advance and add a small sidecar to all pods that need it