<p>Consider the following manifest:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: firstpod
spec:
  containers:
  - name: container2
    image: varunuppal/nonrootsudo
    tty: false
    stdin: false
</code></pre>
<p>I have read here that tty indicates &quot;</p>
<pre><code>Whether this container should allocate a TTY for itself
</code></pre>
<p>so If understand it well, setting it to false, it should not be possible to run into the container with kubectl exec -ti firstpod bash. However, I am still able to do it !!!</p>
<p>I have read <a href="https://stackoverflow.com/questions/39886146/kubectl-attach-unable-to-use-a-tty-container-es-node-did-not-allocate-one">this answer</a> bu my problem is the &quot;other way&quot; : I set tty to false but still can execute commands in the container</p>
<p>What did I misunderstand?</p>

Abdelghani
<p><code>kubectl exec</code> is a <em>debugging tool</em> that spawns an additional process inside an existing pod's container.  That additional process can independently have a virtual tty attached to it, or not.  Separately, you can also usually run an interactive shell with or without a tty attached to it, so long as it can still read commands from its stdin and write responses to its stdout.</p>
<p>In practice you should almost never need to set <code>tty: true</code> for a Kubernetes container.  Setting it or not only affects the main process in the container and not anything you launch with <code>kubectl exec</code> or other similar debugging tools.</p>
<p>If your goal here is to prevent <code>kubectl exec</code> then you need to use the Kubernetes permissions system to disallow it.  In some cases it may be possible to build a very hardened container that doesn't contain a shell, which would also effectively disable <code>kubectl exec</code> (though it also makes some kinds of debugging much harder); this is only really possible if you're using a compiled language and don't need a complex launcher script (most often, a <code>FROM scratch</code> image for a statically-linked Go program).</p>
