148

I have one pod running with name 'jenkins-app-2843651954-4zqdp'. I want to install few softwares temporarily on this pod. How can I do this?

I am trying this- kubectl exec -it jenkins-app-2843651954-4zqdp -- /bin/bash and then running apt-get install commands but since the user I am accessing with doesn't have sudo access I am not able to run commands

1
  • 2
    you could add this to pod, but after exit it will be gone. Better alter the docker image and add soft Commented Mar 14, 2017 at 19:52

20 Answers 20

126
  • Use kubectl describe pod ... to find the node running your Pod and the container ID (docker://...)
  • SSH into the node
  • Run docker exec -it -u root CONTAINER_ID /bin/bash
6
  • 20
    how to ssh into the node in this case?
    – Wenjing
    Commented Jun 18, 2018 at 22:35
  • 16
    Nevermind, I found the answer myself. I am using google cloud. The command to ssh into node is: gcloud compute instances list gcloud compute ssh <your_instance_name>
    – Wenjing
    Commented Jun 18, 2018 at 22:51
  • 16
    should be docker exec -it -u root ID /bin/bash
    – Pilo
    Commented Dec 19, 2018 at 20:19
  • 10
    If it helps anyone, ID above means docker container id. AFAIK, kubectl won't show the correct docker container id. We have to use docker ps to get the correct docker container id.
    – user674669
    Commented Feb 1, 2019 at 19:22
  • 26
    Kinda obsolete answer now, considering that Docker has been deprecated in K8s version 1.20. Commented Oct 27, 2021 at 7:48
35

There are some plugins for kubectl that may help you achieve this: https://github.com/jordanwilson230/kubectl-plugins

One of the plugins called, 'ssh', will allow you to exec as root user by running (for example) kubectl ssh -u root -p nginx-0

2
  • Super! I can't believe this plugin hasn't become as popular as it deserves. However, the krew plugin for kubectl exec-as ... doesn't seem to be keeping up with the latest Kubernetes. See my comment in the follow-up answer below. Commented Feb 8, 2022 at 18:54
  • 3
    This plugin is not working with a modern k8s version, like 1.22 for example, that is using containerd. See github.com/jordanwilson230/kubectl-plugins/issues/40. Commented Oct 18, 2022 at 10:07
26

Based on henning-jay's answer (the containerd case):

  • determine the container id:

    $ kubectl get pod POD \
      -o jsonpath="{.status.containerStatuses[].containerID}" \
      | sed 's,.*//,,'
    7e328fc6ac5932fef37f8d771fd80fc1a3ddf3ab8793b917fafba317faf1c697
    
  • determine the pod's node:

    $ kubectl get pod POD -o wide
    NAME                                   READY   STATUS    RESTARTS   AGE   IP             NODE                      NOMINATED NODE   READINESS GATES
    some-pod-xxxxxxxxxx-xxxxx              1/1     Running   0          19h   xx.xxx.xx.xxx  some-node-xxxxxxxx-xxxx   <none>           <none>
    
  • on the node use runc (--root is needed since it's used by containerd):

    $ runc --root /run/containerd/runc/k8s.io/ \
      exec -tu 0 \
      7e328fc6ac5932fef37f8d771fd80fc1a3ddf3ab8793b917fafba317faf1c697 \
      sh
    

    or ctr:

    $ ctr --namespace=k8s.io task exec -t \
      --user root --exec-id 1 \
      7e328fc6ac5932fef37f8d771fd80fc1a3ddf3ab8793b917fafba317faf1c697 \
      sh
    
0
13

Building on @jordanwilson230's answer he also developed a bash-script called exec-as which uses Docker-in-Docker to accomplish this: https://github.com/jordanwilson230/kubectl-plugins/blob/krew/kubectl-exec-as

When installed via kubectl plugin manager krewkubectl krew install exec-as you can simply

kubectl exec-as -u <username> <podname> -- /bin/bash

This only works in Kubernetes clusters which allow priviledged containers.

3
  • 5
    Maybe this exec-as plugin hasn't been maintained lately? It doesn't work on AWS EKS v1.21. It simply hangs there till error: timed out waiting for the condition. However, the original kubectl ssh -u root ... works as shown in @jordanwilson230's original answer above. That makes me think that the exec-as plugin version is falling behind of that of ssh plugin. Commented Feb 8, 2022 at 18:51
  • 1
    This also seems to only work on clusters that use docker runtime, or at least it didn't work on one that uses containerd.
    – Andrew
    Commented Mar 22, 2022 at 6:43
  • @VincentYin The Pod "root-1" is invalid: spec.containers[0].restartPolicy: Forbidden: may not be set for non-init containers , but I still get timeout after removing the option
    – sherpya
    Commented May 22 at 11:36
13

If you're using a modern Kubernetes version it's likely running containerd instead of docker for it's container runtime.

To exec as root you must have SSH access and SUDO access to the node on which the container is running.

  1. Get the container id of the pod. Example:
 kubectl get pod cassandra-0 -n cassandra -o jsonpath="{.status.containerStatuses[].containerID}" | sed 's/.*\/\///'
8e1f2e5907087b5fd55d98849fef640ca73a5ca04db2e9fc0b7d1497ff87aed9
  1. Use runc to exec as root. Example:
sudo runc --root /run/containerd/runc/k8s.io/ exec -t -u 0 8e1f2e5907087b5fd55d98849fef640ca73a5ca04db2e9fc0b7d1497ff87aed9 sh
1
  • I am unable to install packages after getting access to the container due to E: List directory /var/lib/apt/lists/partial is missing. - Acquire (30: Read-only file system). Any way around this?
    – pkaramol
    Commented Oct 3, 2023 at 9:13
12

For my case, I was in need for root access (or sudo) to container to give the chown permission to a specific mount path.

I cannot SSH to machine because I designed my infrastructure to be fully automated with Terraform without any manual access.

Instead, I found that initContainers does the job:

  initContainers:
    - name: volume-prewarming
      image: busybox
      command: ["sh", "-c", "chown -R 1000:0 {{ .Values.persistence.mountPath }}"]
      volumeMounts:
      - name: {{ .Chart.Name }}
        mountPath: {{ .Values.persistence.mountPath }}

I've also created a whole course about Production grade running kubernetes on AWS using EKS

1
  • Hi Abdennour. I am running through a similar issue, however I am using a git-sync sidecar that I mount. Once the sidecar is mounted the owner of the volume becomes root. I have added a question here if you can help : ) stackoverflow.com/questions/65457870/…
    – alt-f4
    Commented Dec 26, 2020 at 16:19
12

Just in case you come across to look for an answer for minikube, the minikube ssh command can actually work with docker command together here, which makes it fairly easy:

  1. Find the container ID:

    $ minikube ssh docker container ls
    
  2. Add the -u 0 option to docker command (quote is necessary for the whole docker command):

    $ minikube ssh "docker container exec -it -u 0 <Container ID> /bin/bash"
    

NOTE: this is NOT for Kubernetes in general, it works for minikube only. While I feel we need the root access quit a lot in local development environment, it's worth to mention it in this thread.

5

In k8s deployment configuration, you can set to run the container as root

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: my-app
spec:
  template: 
    spec:
      containers:
      - image: my-image
    name: my-app
    ...
    securityContext:
      allowPrivilegeEscalation: false
      runAsUser: 0

Notice that runAsUser: 0 property. Then connect to the POD/container as usual and you will be authenticated as root from the beginning.

2
  • 1
    Insecure. This would run the main service as root. I guess the question was about just debugging/administering as root. Commented May 18, 2023 at 13:20
  • 2
    @RaúlSalinas-Monteagudo, yep, the question was about a temporary solution for installing extra software, then after the debugging is done that change should be reverted back.
    – humkins
    Commented May 26, 2023 at 11:33
4

UPDATE k8s v1.27.4 2023-10: (After switch from DOCKER to CONTAINERS)

Lets sumarize what I found here in posts, comments and links. This works for me:

# First get list of nodes:
kubectl get nodes                                                                   
$ NAME                 STATUS     ROLES                  AGE     VERSION
$ node-control-plane   Ready      control-plane,master   4d16h   v1.21.1
$ node-worker          NotReady   <none>                 4d16h   v1.21.1
$ node-worker2         Ready      <none>                 4d16h   v1.21.1

# Start pod based on ubuntu which will connect direct inside the node:
kubectl debug node/node-worker -it --image=ubuntu
$ Creating debugging pod node-debugger-ip-10-0-5-223.eu-west-2.compute.internal-6gs8d with container debugger on node ip-10-0-5-223.eu-west-2.compute.internal.
$ If you don't see a command prompt, try pressing enter.
root@ip-10-0-5-223:/# 

# Now you are connected on debug pod and content of node filesystem is at /host
# Lets chroot there:
root@ip-10-0-5-223:/# chroot /host
sh-4.2# 

# Now you are connected inside node, so you can check used space (df -h), running processes (top) or install things with yum (yum install htop mc -y)

# Lets get root access to some pod on this node, you need to find its CONTAINER ID:
sh-4.2/ docker ps 
OR
sh-4.2/ ctr -n k8s.io containers list
#or "docker ps | less" then move around with arrows to find  correct CONTAINER ID and quit with q
$ CONTAINER ID    IMAGE     COMMAND         CREATED             STATUS             PORTS     NAMES
$ 0d82a8768c1e    centos    "/bin/bash"     2 minutes ago       Up 2 minutes                 k8s_prometheus-ip-11-2-6-218.compute.internal-alksdjf_default_asldkfj-lsadkfj-lsafjdk

sh-4.2/ docker exec -it -u root 0d82a8768c1e /bin/bash
OR
sh-4.2/ ctr -n k8s.io tasks exec --exec-id 1 0d82a8768c1e /bin/bash
(you can validate if container have running task by: ctr -n k8s.io tasks ls)
(if /bin/bash fails, try /bin/sh)
$ root@centos:/# 
#and here we are, inside pod with root account - good luck.


Sources: Open a shell to a node using kubectl and post above

3

In case anyone is working on AKS, follow these steps:

  • Identify the pod that is running the container
  • Identity the node that is running that pod (kubectl describe pod -n <namespace> <pod_name> | grep "Node:", or look for it on Azure portal)
  • SSH to AKS the cluster node

Once you are inside a node, perform these commands to get into the container:

  • sudo su (you must get root access to use docker commands)
  • docker exec -it -u root ID /bin/bash (to get the container id, use docker container ps)
3

A colleague of mine found this tool: https://github.com/ssup2/kpexec

It runs a highly privileged container on the same node as the target container and joins into the namespaces of the target container (IPC, UTS, PID, net, mount)

[...] kpexec now supports the following container runtimes.

  • containerd
  • CRI-O
  • Docker

[...] The cnsenter pod must be created with hostPID and Privileged Option

To get root you could run something like

kpexec -it  jenkins-app-2843651954-4zqdp  -- /bin/bash
2

To login as different i use exec-as plugin in kubernetes here are the steps you can follow

Make sure git is installed

Step : 1 Install Krew plugin

  begin
  set -x; set temp_dir (mktemp -d); cd "$temp_dir" &&
  set OS (uname | tr '[:upper:]' '[:lower:]') &&
  set ARCH (uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/') &&
  set KREW krew-$OS"_"$ARCH &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/$KREW.tar.gz" &&
  tar zxvf $KREW.tar.gz &&
  ./$KREW install krew &&
  set -e KREW; set -e temp_dir
end

Step : 2 Install exec-as

kubectl krew install exec-as

Step : 3 Try with root or different user

kubectl exec-as -u root frontend-deployment-977b8fd4c-tb5pz

WARNING: You installed plugin "prompt" from the krew-index plugin repository. These plugins are not audited for security by the Krew maintainers. Run them at your own risk.

1
  • Thanks for providing an easy way to use this plugin, but it has been recommended in previous answers before. And it's not working with modern k8s using containerd instead of docker. Commented Oct 18, 2022 at 10:11
2

Working with kubernetes 1.21, none of the docker and kubectl-plugin approaches worked for me. (since k8s 1.21 uses cri-o as container runtime).

What did work for me was using runc:

  • get containerID via

kubectl get pod -o jsonpath="{.status.containerStatuses[].containerID}" | sed 's/.*////'

  • containerID is something like

4ed493495241b061414b94425bb03b682534241cf19776f8809aeb131fa5a515

  • get node pod is running on
kubectl describe pod <podname>  | grep Node:
    Node:         mynode.cluster.cloud.local/1.1.148.63
  • ssh into node

  • on node, run (might have to use sudo):

runc exec -t -u 0 containerID sh

so something like:

runc exec -t -u 0 4ed493495241b061414b94425bb03b682534241cf19776f8809aeb131fa5a515 sh

1

I am using the following

  1. Install https://krew.sigs.k8s.io/
  2. Install https://github.com/ssup2/kpexec into kubectl using krew by running kubectl krew install pexec.
  3. [Assuming your kubectl is pointing to correct cluster], Connect to pod/container using kubectl pexec -it -n <namespace> <pod name> [-c <container name>] -- bash

Additional info:

If target container is is Debian, if you want to install any generic tools like htop etc, if no softwares were pulled before, you 1st need to run apt-get update followed by apt-get install htop

1
  • This works very well, even on systems where you DO NOT have ssh access to the nodes.
    – spkane
    Commented Jan 18 at 0:42
0

After you get the node name, another way to get ssh into it is using:

kubectl debug node/<node_name> -it --image=<image>

eg:

kubectl debug node/my_node -it --image=ubuntu

and after that:

chroot /host

usage example

0

In my experience, when using k3s v1.27.6+k3s1, I found that the runc command was not available. Instead, I utilized the ctr command. Here's how you can do it:

Firstly, you need to identify the container ID. This can be done using the following command:

kubectl -n wordpress describe pod <podname> | grep 'Container ID:'

For instance, you might get an output similar to this:

    Container ID:   containerd://aaff66aaaeca129eab1b8e51ebf391fd59191f41db5540c1e8af65675737073e

Once you have the container ID, you can use the ctr command to execute commands within the container. Here's an example:

sudo k3s ctr task exec -t --exec-id myshell --user root aaff66aaaeca129eab1b8e51ebf391fd59191f41db5540c1e8af65675737073e bash

In this command, replace aaff66aaaeca129eab1b8e51ebf391fd59191f41db5540c1e8af65675737073e with your own container ID. This will allow you to execute commands within your specific container.

0

Another example for minikube:

cat minio.local.com.crt | minikube ssh "docker exec -it --user root 73ab2f3556ee bash -c \"tee ./tmp/minio.local.com.crt\""

minikube ssh "docker exec -it --user root 73ab2f3556ee bash -c \"ls /tmp\""
  • You can find your container id by running minikube ssh and then the usually docker ps command.
0

Based on the answer of @Henning Jay, on 1.25 version of kubernetes, when you get container id, you can use following command to enter the container with root user.

ctr -n k8s.io task exec --user 0 --exec-id 0 -t <container id> /bin/bash
-10
  • docker container ls to find container ID
  • docker exec -it -u root ID /bin/bash
2
  • 3
    The question is about kubernetes cluster. This solution does not work for remote cluster.
    – eNca
    Commented Jul 9, 2021 at 14:53
  • But it works perfectly for local cluster. Upvoted it. Commented May 9, 2023 at 9:31
-30

We can exec into kubernetes pod through the following command.

kubectl exec --stdin --tty pod-name -n namespace-name -- /bin/bash
1
  • 4
    The post is asking about executing commands as root. I don't understand what you mean.
    – aloplop85
    Commented Sep 24, 2020 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.