Shells, logs and forwards

Exec

Shells run over v5.channel.k8s.io into xterm, on a binary WebSocket carrying the Kubernetes exec channel protocol.

An image with no shell of its own gets an ephemeral debug container instead. The verdict is cached per image digest, so the check happens once per image rather than once per attempt. Creating one calls kubectl; --kubectl points at a different binary and --debug-image at a different image.

Node shell

A root shell in the node's own namespaces, opened from the node panel. It is off until you turn it on, because it creates a privileged pod.

Before offering it, Spinoza asks the apiserver whether you may create that pod. The pod carries a two-hour deadline so it cannot outlive the session that opened it.

Logs

Logs stream per container. Pausing follow stops the scroll, not the stream, so nothing is missed while you read.

Port-forwarding

Any pod or service on localhost, without kubectl. Forwards live in a process-global registry independent of any request, so they survive navigation; one panel lists them and stops them.