Why does the oc debug command fail with a container is unable to start error?

When you run the oc debug command on a private cluster, you see an error message similar to the following.

oc debug node/<node-name>
Starting pod/1024104-debug ...
To use host binaries, run `chroot /host`

warning: Container container-00 is unable to start due to an error: Back-off pulling image "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:7dd7a3a1be7009629c709e6c88a1551d471aba9bf3deb873bc5f4d814675edfe"

The oc debug command starts a debug pod on the node that you specify. The debug pod uses a public container image from the quay.io container registry. On private clusters without access to the public Internet, your cluster can't pull the debug container image from the public registry.

To resolve this issue, pull an ocp-release image from quay.io and push it to your private image registry. Then, when you run the oc debug command, specify the private container image that you want to use.

1. Pull an image from quay.io that matches your cluster version and architecture. For example, if you have a 4.7.19 cluster, pull the quay.io/openshift-release-dev/ocp-release:4.7.19-x86_64 image. Note that you must have a Red Hat account and permissions to pull images.

   docker pull quay.io/openshift-release-dev/ocp-release:4.7.19-x86_64
   

2. Tag and push the image to your private container registry.

3. Retry the oc debug command with the --image=icr.io option.

   oc debug node/<node-name> --image=icr.io/<namespace>/<image>:<tag>