How to Execute Commands Inside a Kubernetes Pod

In this tutorial, you'll learn about How to Execute Commands Inside a Kubernetes Pod. We cover key concepts, practical examples, and best practices.

The Problem

Your pod is running but you can't SSH into it — containers don't run SSH servers. You need to inspect files, check environment variables, test network connectivity, or debug a running process inside the container. kubectl exec runs commands directly inside any container in your cluster. Kubernetes translates the exec request through the API server to the kubelet, which runs the command in the container's namespace.

Quick Fix

1. Start an interactive shell inside a pod

kubectl exec -it my-pod -- /bin/sh

The -it flags combine -i (interactive, keep stdin open) and -t (allocate a pseudo-TTY). -- separates kubectl flags from the command to run inside the container. Use /bin/bash if the image includes it.

2. Run a single command and exit

kubectl exec my-pod -- env

Expected output:

PATH=/usr/local/bin:/usr/bin:/bin
NODE_ENV=production
DB_HOST=postgres-service

No -it needed for non-interactive commands. The output goes directly to your terminal.

3. Specify a container (multi-container pods)

kubectl exec -it my-pod -c sidecar -- /bin/sh

The -c flag selects which container to execute the command in. Required when the pod has more than one container.

4. Copy files to/from a pod

# Copy file from pod to local machine
kubectl cp my-pod:/app/config.json ./config.json

# Copy file from local to pod
kubectl cp ./config.json my-pod:/app/config.json

kubectl cp works like scp but for pods. It requires the tar binary inside the container.

5. Check network connectivity from inside a pod

kubectl exec my-pod -- curl -s http://service-name:8080/health
kubectl exec my-pod -- ping -c 3 google.com

This runs network diagnostics from the pod's network namespace, which is useful for debugging service discovery and network policies.

6. Inspect running processes

kubectl exec my-pod -- ps aux

Expected output:

USER       PID  %CPU  %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  12345  6789 ?        Ssl  10:30   0:00 node app.js
root        10  0.0  0.0   4321  1234 ?        Rs   10:35   0:00 ps aux

7. Set environment variables for the exec command

kubectl exec my-pod -- env DEBUG=1 node app.js

8. Debug with a temporary sidecar container

kubectl debug my-pod -it --image=nicolaka/netshoot

This creates an ephemeral container (or a copy of the pod with additional containers) with common networking and debugging tools like curl, ping, tcpdump, and dig. The temporary container shares the same network namespace as the target pod.

Prevention

• Use kubectl exec -it for interactive debugging, omit -it for automated commands
• Always specify the container with -c in multi-container pods
• Use kubectl cp for file transfer instead of mounting volumes for quick fixes
• Prefer kubectl logs over kubectl exec for viewing application output
• Use kubectl exec -- sh -c "command1 && command2" for multi-step commands
• Use kubectl debug for pods that lack common debugging tools in their image