Kubernetes v1.36 Releases User Namespaces as General Availability Feature
Kubernetes version 1.36 has officially released User Namespaces support as a General Availability (GA) feature, marking a significant milestone for container security on Linux systems. This update enables 'rootless' security isolation for Kubernetes workloads, addressing the critical vulnerability where processes running as root inside a container are recognized as root on the host kernel. By setting hostUsers to false in the Pod specification, capabilities such as CAP_NET_ADMIN become namespaced, granting administrative power only over container-local resources without affecting the host system. The implementation relies on ID-mapped mounts, introduced in Linux kernel 5.12, which allow the kernel to transparently translate UIDs and GIDs at mount time. This approach eliminates the need for expensive recursive chown operations on volumes, ensuring instant and efficient O(1) performance. This feature allows users to run privileged workloads while maintaining strict confinement, enabling new use cases that previously required fully privileged containers. The interface remains consistent with earlier alpha phases, requiring no changes to container images or complex configurations, thereby simplifying adoption for developers seeking enhanced security isolation.
Wire timeline
Kubernetes v1.36 Releases User Namespaces as General Availability Feature
Kubernetes version 1.36 has officially released User Namespaces support as a General Availability (GA) feature, marking a significant milestone for container security on Linux systems. This update enables 'rootless' security isolation for Kubernetes workloads, addressing the critical vulnerability where processes running as root inside a container are recognized as root on the host kernel. By setting hostUsers to false in the Pod specification, capabilities such as CAP_NET_ADMIN become namespaced, granting administrative power only over container-local resources without affecting the host system. The implementation relies on ID-mapped mounts, introduced in Linux kernel 5.12, which allow the kernel to transparently translate UIDs and GIDs at mount time. This approach eliminates the need for expensive recursive chown operations on volumes, ensuring instant and efficient O(1) performance. This feature allows users to run privileged workloads while maintaining strict confinement, enabling new use cases that previously required fully privileged containers. The interface remains consistent with earlier alpha phases, requiring no changes to container images or complex configurations, thereby simplifying adoption for developers seeking enhanced security isolation.
Kubernetes Blog