kubectl cp failed because your container has no tar. You ask kubectl to copy app.log from the pod web-7f9. kubectl sends an exec request through the API Server, asking the container to run tar. But this minimal image doesn't include it. So the container reports tar not found, kubectl passes that error back, and the copy fails with no local file.

kubectl cp isn't a special file transfer. It wraps kubectl exec, which runs tar cf dash inside the container. That tar binary packs app.log and writes it to stdout as a byte stream. Back on your laptop, kubectl untars the stream and writes app.log locally. The packing step depends on the container's own tar.

On a full image, app.log passes through the tar inside the container and reaches your laptop. On a minimal image, that tar box is simply missing, so the stream stops before anything arrives.

The command is identical. What changed is whether tar exists inside the container, and kubectl cp depends on it.

The fix is to read app.log from somewhere that has tar. One option is a shared volume. The app writes the log there, a helper container with tar mounts the same volume, and kubectl cp runs against the helper. The other is kubectl debug, which attaches a debug container that brings its own tools.

kubectl cp borrows tar from your container. For minimal images, plan a shared volume or a debug container. kubectl cp borrows tools from your container. Yours didn't have any.