OCI runtime exec failed: kubectl exec reached the container and the command could not be run inside it

This means the connection worked and the runtime could not execute what you asked for — usually because the binary does not exist in the image. Minimal images have no shell at all.

Applies to: All Kubernetes versions

What it means

kubectl exec asks the runtime to run a command in an existing container's namespaces. When the command is absent, the runtime reports OCI runtime exec failed: exec failed: … executable file not found in $PATH. This is a different failure from being unable to establish the connection: the tunnel worked and the container was reached. The most common trigger is running kubectl exec POD -- /bin/bash against an image with no bash, or any command at all against a distroless or scratch image, which contains only the application binary and its libraries.

Most common causes

• The image has no shell — distroless, scratch, and many minimal images do not.
• /bin/bash requested in an image that only ships /bin/sh.
• The command exists but is not on PATH for the exec session.
• The container's user lacks permission to execute the command.
• The container is not running, so there is nothing to execute in.
• The wrong container named in a multi-container pod.

How to diagnose it

1. Try sh instead of bash: kubectl exec -it POD -- /bin/sh.
2. Check what the image is built from — a distroless or scratch base explains it immediately.
3. Confirm the container is running: kubectl get pod POD.
4. Name the container explicitly if the pod has several: kubectl exec -it POD -c CONTAINER -- sh.
5. Use an absolute path if PATH may not include the binary's location.

How to fix it

1. Use an ephemeral debug container, which attaches a full toolbox to the running pod without changing the image: kubectl debug -it POD --image=busybox --target=CONTAINER.
2. Use /bin/sh rather than /bin/bash for minimal images that have one.
3. Do not add a shell to a production image to make debugging easier — ephemeral containers exist precisely so that trade-off is unnecessary.
4. Name the correct container in a multi-container pod.
5. Use an absolute path to the binary.

Notes

Ephemeral debug containers share the target pod's namespaces, so a busybox or a full debugging image can inspect the process, the network, and the filesystem of a distroless container without that container shipping a single extra binary.

Related

• unable to upgrade connection — exec or attach could not establish its connection
• Exit code 127 — Command not found

Sources

• Kubernetes documentation — kubectl exec
• Kubernetes documentation — Debug Running Pods: ephemeral containers
• OCI Runtime Specification