kubectl cp: tar not found: kubectl cp needs a tar binary inside the container and there is not one

kubectl cp is implemented by piping a tar stream through kubectl exec. Without tar in the image, it cannot work — which rules it out for distroless and scratch images entirely.

Applies to: All Kubernetes versions

What it means

kubectl cp is not a native API operation. It runs tar inside the container through the exec channel and streams the archive across. That implementation detail is invisible until the image has no tar, at which point the command fails with an error about the binary being missing. Minimal images — distroless, scratch, and many purpose-built ones — deliberately contain nothing but the application, so the command is simply unavailable there. It is worth knowing this is a limitation of the mechanism rather than a misconfiguration, because no amount of adjusting the command will work around it.

Most common causes

• The image contains no tar binary, as with distroless and scratch images.
• tar is present but not on PATH.
• A busybox tar whose behaviour differs enough to break the transfer.
• The exec channel itself being unavailable, which produces a different but related failure.
• Insufficient permissions to write the destination path inside the container.

How to diagnose it

1. Check whether the binary exists: kubectl exec POD -- which tar. An error here is the confirmation.
2. Check whether exec works at all, since cp depends on it.
3. Check the destination path's permissions for the container's user.
4. Identify the base image — a distroless or scratch base settles it immediately.

How to fix it

1. Use an ephemeral debug container that shares the pod's namespaces and does have tools: kubectl debug -it POD --image=busybox --target=CONTAINER.
2. Stream the file through exec instead: kubectl exec POD -- cat /path/to/file > local-file for reading, and the reverse with a shell for writing.
3. Mount a volume for files that need to move in and out routinely, rather than copying them ad hoc.
4. Add tar to the image only if the operational need genuinely justifies enlarging the attack surface — usually it does not.
5. For getting files out of a container regularly, write them to a volume or object storage from the application itself.

Notes

Needing to copy files in and out of a running container is often a sign that something belongs in a volume or in the image. The limitation is a mild inconvenience for one-off debugging and a design signal if it comes up repeatedly.

Related

• unable to upgrade connection — exec or attach could not establish its connection
• Exit code 127 — Command not found

Sources

• Kubernetes documentation — kubectl cp
• Kubernetes documentation — Debug Running Pods: ephemeral containers
• Kubernetes documentation — kubectl exec