How do you debug a crashing or minimal (distroless) pod that has no shell?
Quick Answer
Use kubectl debug to attach an ephemeral debug container, or --copy-to to create a copy of the pod with a debug container and (optionally) a changed command, so you can investigate without altering the live pod.
Detailed Answer
Distroless/scratch images have no shell or tools, so you cannot exec into them. kubectl debug injects an ephemeral container sharing the target pod namespaces (process, network) with a toolbox image like busybox. --copy-to=debug-pod clones the pod so you can, for example, override the entrypoint to keep it running and inspect the filesystem/network of a crash-looping workload safely.
Code Example
kubectl debug -it <pod> --image=busybox --copy-to=debug-pod
Interview Tip
Explain ephemeral containers share the target namespaces, which is why this works on distroless images with no shell.