How to Run a Kubernetes Sidecar Container in a Pod

What the sidecar pattern does

Every container in a pod shares the pod's network namespace - they all see localhost and the same port space. Sidecars exploit this: the helper container runs next to the app and can read its log files, proxy its traffic, or sync its config, all without modifying the app image.

Common real-world sidecars: Envoy (Istio/Linkerd mesh proxy), Fluent Bit (log forwarding), Vault Agent (secret injection), and CloudSQL Proxy (DB auth).

Adding a sidecar to a Deployment

Start from a single-container Deployment and add a second entry under containers. A shared emptyDir volume lets both containers exchange files:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app
  template:
    metadata:
      labels:
        app: app
    spec:
      volumes:
      - name: shared
        emptyDir: {}
      containers:
      - name: app
        image: nginx:1.27-alpine
        ports:
        - containerPort: 80
        volumeMounts:
        - name: shared
          mountPath: /var/log/shared
      - name: sidecar
        image: busybox:1.36
        command: ["sh", "-c", "while true; do echo tick >> /var/log/shared/sidecar.log; sleep 10; done"]
        volumeMounts:
        - name: shared
          mountPath: /var/log/shared

Apply and verify both containers are running:

kubectl apply -f deployment.yaml
kubectl get pods
kubectl get pods -o jsonpath='{.items[0].spec.containers[*].name}'
# app sidecar

Inspecting containers in the same pod

Use -c to exec into a specific container:

# exec into the sidecar
kubectl exec -it <pod> -c sidecar -- sh

# read the log from the app container (they share the volume)
kubectl exec -it <pod> -c app -- cat /var/log/shared/sidecar.log

Key rules

• One pod spec, multiple containers - both are listed under spec.containers; Kubernetes starts them together and restarts them together.
• Shared network - containers in the same pod can call each other on localhost without any Service. If the sidecar runs a proxy on port 15001, the app hits localhost:15001.
• emptyDir for file sharing - an emptyDir volume lives for the pod's lifetime and is the standard way to pass files between sidecar and app. Mount the same volume name in both containers at whatever path makes sense.
• Init containers vs sidecars - if the helper should run to completion before the app starts (e.g. download a config), use an initContainer instead. Sidecars run for the pod's entire lifetime alongside the app.