{"record":{"id":"4af179fbd7d2ca9d","repo":"derailed/k9s","slug":"kubectl-command-must-not-be-in-the-current-working","errorCode":null,"errorMessage":"kubectl command must not be in the current working directory: %w","messagePattern":"kubectl command must not be in the current working directory: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/view/exec.go","lineNumber":61,"sourceCode":"\nvar editorEnvVars = []string{\"K9S_EDITOR\", \"KUBE_EDITOR\", \"EDITOR\"}\n\ntype shellOpts struct {\n\tclear, background bool\n\tpipes             []string\n\tbinary            string\n\tbanner            string\n\targs              []string\n}\n\nfunc (s shellOpts) String() string {\n\treturn fmt.Sprintf(\"%s %s\", s.binary, strings.Join(s.args, \" \"))\n}\n\nfunc runK(a *App, opts *shellOpts) error {\n\tbin, err := exec.LookPath(\"kubectl\")\n\tif errors.Is(err, exec.ErrDot) {\n\t\treturn fmt.Errorf(\"kubectl command must not be in the current working directory: %w\", err)\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kubectl command is not in your path: %w\", err)\n\t}\n\targs := []string{opts.args[0]}\n\tif u, err := a.Conn().Config().ImpersonateUser(); err == nil {\n\t\targs = append(args, \"--as\", u)\n\t}\n\tif g, err := a.Conn().Config().ImpersonateGroups(); err == nil {\n\t\targs = append(args, \"--as-group\", g)\n\t}\n\tif isInsecure := a.Conn().Config().Flags().Insecure; isInsecure != nil && *isInsecure {\n\t\targs = append(args, \"--insecure-skip-tls-verify\")\n\t}\n\targs = append(args, \"--context\", a.Config.K9s.ActiveContextName())\n\tif cfg := a.Conn().Config().Flags().KubeConfig; cfg != nil && *cfg != \"\" {\n\t\targs = append(args, \"--kubeconfig\", *cfg)\n\t}","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/derailed/k9s/blob/2d3ccc6ba2ce98c3781bfc441bb3e884f072774f/internal/view/exec.go#L43-L79","documentation":"runK() resolves kubectl with exec.LookPath. Since Go 1.19, LookPath returns the sentinel error exec.ErrDot when the resolved binary is a relative path — i.e. kubectl was found in the current working directory (./kubectl), which Go refuses to use implicitly for security (a hostile writable directory could hijack command resolution). k9s surfaces this explicitly instead of silently running the local binary.","triggerScenarios":"Starting k9s in a directory that contains a kubectl executable and no earlier PATH entry wins — e.g. you downloaded kubectl into a project folder and launch k9s from there, invoking any kubectl-shelling feature (shell, port-forward helpers, kubectl prompts).","commonSituations":"Per-project kubectl binaries (version managers that drop kubectl into ./bin with PATH=.:/bin styles); CI scripts that cd into a tools directory; users following install docs that say 'download kubectl here' and run k9s in the same dir.","solutions":["Install kubectl into a real PATH directory (e.g. /usr/local/bin/kubectl) so it resolves absolutely","Remove or rename the ./kubectl in your working directory before launching k9s","Launch k9s from a directory that does not contain a kubectl binary"],"exampleFix":"# before — running k9s from a dir containing ./kubectl\n$ cd ~/project && ls kubectl\n$ k9s            # any kubectl-backed feature fails with ErrDot\n# after\n$ sudo mv ~/project/kubectl /usr/local/bin/kubectl\n$ k9s            # resolves via PATH, works","handlingStrategy":"validation","validationCode":"// preflight: resolve kubectl and refuse cwd-relative hits before running\nbin, err := exec.LookPath(\"kubectl\")\nif errors.Is(err, exec.ErrDot) {\n    return fmt.Errorf(\"refusing ./kubectl — install kubectl on PATH\")\n}\nif path.IsAbs(bin) { /* safe to proceed */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never keep a kubectl binary in directories you launch k9s from","Install kubectl under /usr/local/bin or ~/.local/bin listed early in PATH","Treat exec.ErrDot as a security signal — a writable-dir binary hijack, not an inconvenience"],"tags":["kubernetes","k9s","exec","environment","security"],"backgroundTag":null,"analyzedSha":"2d3ccc6ba2ce98c3781bfc441bb3e884f072774f","analyzedAt":"2026-08-15T16:09:14.432Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}