Break-glass · 01 of 07 · The idea

Exec, or a debug container?

Both give you a shell next to the app. Only one of them hands the cluster something it can inspect before saying yes.

Exec, or a debug container? Two columns. Left, kubectl exec: a person with cluster rights runs kubectl exec into a pod. The API server sees one request, CONNECT pods/exec, and admission can only allow or deny it. The shell runs inside the app container, as the app's user, with its tools and its secrets. That means writes land in the running app, a distroless image has no shell at all, and nothing is left behind in the pod. Right, a break-glass debug container: an owner, signed in to Tower, presses Debug with a reason. The API server sees UPDATE pods/ephemeralcontainers, and admission reads the whole container spec. What runs is a hardened debug container as user 65532, read-only, with no capabilities. That means one pinned, signed image works for any app, you read only what you opted into, and the container stays in the pod spec, so the pod is restarted at the end. KUBECTL EXECA BREAK-GLASS DEBUG CONTAINERkubectl exec -it pod -- sha person with cluster rightsCONNECT pods/execall admission can see: allow or denyInside the app containerthe app's user · its tools · its secretsWrites land in the running appA distroless image has no shellNothing left behind in the podDebug, in Toweran owner, signed in, with a reasonUPDATE pods/ephemeralcontainersadmission reads the whole container specA hardened debug containeruid 65532 · read-only · no capabilitiesOne pinned, signed image, any appReads only what you opted intoStays in the pod spec: restartExec is a door you can only lock or unlock. A debug container is a request the cluster can read.LEGENDWho asksThe app, as it runsWhat exec meansWhat the cluster checksWhat you get instead

All or nothing

Exec is a single verb on a single subresource. A policy can refuse it or allow it, and nothing in between.

Inspectable

An ephemeral container arrives as a full spec: image, user, capabilities, mounts. Every field is something a policy can check.

Not safe by nature

Run as the app's user with its process namespace shared, a debug container reaches the same secrets as exec. That is why process access is a separate, recorded opt-in.

Hangar · Tower · Break-glass