Secure and Debuggable: Debugging Slim, Scratch and Distroless Kubernetes Containers
summary
Ephemeral Containers GA (Kubernetes 1.25) enables live debugging of scratch, distroless and slim app images without rebuilding them. Demonstrations use kubectl debug and EphemeralContainers API to attach BusyBox or custom debug sidecars, copy tools into the target namespace, chroot into the process PID namespace, and inspect files under /proc. They show a Node app toggled to debug with SIGUSR1 and a breakpoint hit, plus syscall traces with netshoot, coolkit, strace — it works, though advanced mounts and securityContext require the API rather than the default kubectl debug.
AI-written summary · about
chapters (15)
- 0:00Secure and debuggable containers
- 1:07Minimal images hard to debug
- 3:33Kubernetes debugging basics
- 5:24Scratch vs Distroless vs Slim
- 9:37Debugging minimal images
- 12:52Ephemeral containers fix
- 15:25Advanced pod copy debugging
- 17:31Ephemeral containers 1.25
- 18:16Debugging minimal containers
- 19:43Debugging node app demo
- 21:41Debugging with Coolkit
- 25:09Low-level debugging with s-trace
- 25:58Custom debugging images
- 27:20Shell tricks for debugging
- 29:11Key takeaways
related talks
31mSecure Substrate for Container Apps
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
32mSecure containers - Michael Wager and Michael Helwig
31mLet's Build And Break A Container By Hand Without Docker Or LXC
02h 00mKubernetes Security for Developers.
15mSecuring Production Debugging at Hyperscale
43mContainer Security: So Many Options, Use Them All!
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime