How to fix Exit Code 126 in Kubernetes

KubernetesBEGINNERMEDIUMUpdated Dec 6, 2025· 197 views

Exit code 126 means the command was found but cannot be executed, typically due to missing execute permissions. Add chmod +x to your Dockerfile or fix file permissions.

Quick fix

Fixes Exit Code 126

kubectl logs <pod-name>
kubectl logs <pod-name> --previous
  1. Check container logs for permission errors
  2. Fix script permissions in Dockerfile
  3. Verify execute permissions locally
  4. Check if required interpreter exists
kubernetes — error
kubectl logs <pod-name>
kubectl logs <pod-name> --previous
Exit Code 126

What this error means

Exit code 126 indicates that the specified command exists but cannot be executed. This is distinct from exit code 127 (command not found). The most common cause is missing executable permissions on scripts or binaries. In containerized environments, this typically happens when shell scripts are copied into the image without the execute bit set, or when the container runs as a user without permission to execute the specified command.

Typical symptoms

  • Container fails immediately with exit code 126
  • Logs show permission denied errors
  • Entrypoint script found but not executed
  • kubectl exec returns exit code 126
  • kubectl cp fails (requires tar to be executable)
  • Container starts but commands inside fail to run
  • Init containers or lifecycle hooks fail with code 126

Common causes

  1. Shell scripts lack executable permissions (missing chmod +x)
  2. Entrypoint file copied to image without execute bit
  3. Container user lacks permission to execute the command
  4. Required binary is present but not executable
  5. Script interpreter (bash, sh) is not available or executable
  6. SELinux or AppArmor blocking execution
  7. Read-only filesystem preventing execution from certain paths

How to fix "Exit Code 126"

1Check container logs for permission errors

Get the specific error message:

bash
kubectl logs <pod-name>
kubectl logs <pod-name> --previous

Look for messages like:
- "/entrypoint.sh: Permission denied"
- "cannot execute binary file"
- "Operation not permitted"

The error message identifies which file lacks permissions.

2Fix script permissions in Dockerfile

Ensure scripts are executable in your image:

dockerfile
# Copy and set permissions
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Or copy with permissions preserved (if source has +x)
COPY --chmod=755 entrypoint.sh /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]

Rebuild and push the image:

bash
docker build -t myimage:latest .
docker push myimage:latest
3Verify execute permissions locally

Before building, ensure the script has execute permissions:

bash
ls -la entrypoint.sh
# Should show: -rwxr-xr-x

# If not executable, add permission:
chmod +x entrypoint.sh
git add entrypoint.sh
git commit -m "Add execute permission to entrypoint"

Note: Git preserves the execute bit, but some workflows strip it.

4Check if required interpreter exists

Exit code 126 can occur if the script's interpreter isn't available:

bash
# Wrong - bash not in Alpine images
#!/bin/bash

# Correct for Alpine
#!/bin/sh

Verify the interpreter exists in your image:

bash
docker run --rm myimage:latest which sh
docker run --rm myimage:latest which bash

Install bash if needed: RUN apk add --no-cache bash

5Debug by exec-ing into a running container

If the main container won't start, use a debug approach:

yaml
# Temporarily override to keep container running
command: ["sleep", "infinity"]

Then exec in and test:

bash
kubectl exec -it <pod-name> -- /bin/sh

# Check file permissions
ls -la /entrypoint.sh

# Try to execute
/entrypoint.sh
6Check security context and user permissions

The container user may lack execute permissions:

yaml
securityContext:
  runAsUser: 1000
  runAsGroup: 1000

Ensure the file is executable by that user:

dockerfile
# Make executable by all users
RUN chmod 755 /entrypoint.sh

# Or change ownership
RUN chown 1000:1000 /entrypoint.sh && chmod +x /entrypoint.sh

Advanced notes

On Windows, the execute bit isn't preserved in the same way as Linux. If developing on Windows and building images:
- Use git config core.fileMode true to track permission changes
- Add explicit RUN chmod +x in Dockerfile regardless of source permissions

For kubectl cp failures with exit code 126, ensure tar is installed and executable in the container. Many minimal images don't include tar:

dockerfile
RUN apk add --no-cache tar  # Alpine
RUN apt-get update && apt-get install -y tar  # Debian

OCI runtime errors showing exit code 126 may indicate SELinux or AppArmor denying execution. Check node-level security policies if container-level permissions appear correct.

Frequently asked questions

What does "Exit Code 126" mean?
Exit code 126 indicates that the specified command exists but cannot be executed. This is distinct from exit code 127 (command not found). The most common cause is missing executable permissions on scripts or binaries.
How do I fix "Exit Code 126"?
Exit code 126 means the command was found but cannot be executed, typically due to missing execute permissions. Add chmod +x to your Dockerfile or fix file permissions.
What causes "Exit Code 126"?
Shell scripts lack executable permissions (missing chmod +x) Entrypoint file copied to image without execute bit Container user lacks permission to execute the command
Is the "Exit Code 126" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading