# kubectl exec: Command Reference for CI/CD

> Reference for kubectl exec: run a command inside a running container, the -- separator, container selection, and why CI scripts must not allocate a TTY.

Source: https://latchkey.dev/learn/command-reference/kubectl-exec-command-cli-reference  
Updated: 2026-06-26

Run a command inside a live container from your pipeline.

kubectl exec runs a process in an already-running container: check a config file, hit an internal endpoint, or run a one-off migration. This reference covers the flags and the TTY rule that trips up non-interactive CI.

## Common flags and usage

- -- <cmd>: everything after -- runs verbatim in the container
- -i, --stdin: keep stdin open (use when piping input)
- -t, --tty: allocate a TTY (interactive shells only)
- -c <container>: select a container in a multi-container pod
- kubectl exec POD -- CMD: non-interactive, the CI-safe form

## Example

```shell
# Run a DB migration inside the app container, no TTY
kubectl exec deploy/web -c app -- \
  /app/bin/migrate --to=${SCHEMA_VERSION}

kubectl exec my-pod -- cat /etc/config.yaml
```

## In CI

Never pass -t in a pipeline: allocating a TTY without a real terminal mangles output and can hang the step. Keep -i only if you actually pipe input. A distroless image with no shell needs you to exec a static binary it ships, not sh.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### kubectl exec: Command Reference for CI/CD?

kubectl exec runs a process in an already-running container: check a config file, hit an internal endpoint, or run a one-off migration. This reference covers the flags and the TTY rule that trips up non-interactive CI.

### In CI?

Never pass -t in a pipeline: allocating a TTY without a real terminal mangles output and can hang the step. Keep -i only if you actually pipe input. A distroless image with no shell needs you to exec a static binary it ships, not sh.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt