Isolate the Users! Supporting User Namespaces in K8s for Increased Security
summary
Argues that user namespaces cut host risk by mapping container uid0 to a non‑root host id (example: uid0 → 100000 with a 64k range), and proposes KEP-127 to add support. Shows a working prototype in Kubernetes and containerd and demos blocking a known runC overwrite exploit. Covers tradeoffs: snapshot duplication and volume sharing, and how kernel features like idmapped mounts (Linux 5.12) and the proposed pod mode mapping solve them, guiding which modes to implement next.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:00The Problem
- 2:54Mitigations
- 4:26What are username spaces
- 5:10ID mapping
- 6:22Isolate capability
- 7:13Example
- 9:42History
- 11:21Challenges
- 13:18Solution
- 13:55ID Mapping Modes
- 14:59Comparison
- 18:59Demonstration
- 22:16Next steps
related talks
21mMaking Kubernetes Safer with User Namespaces
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
22mRun As “Root”, Not Root: User Namespaces In K8s
39mLinux User Namespaces: A Blessing and a Curse
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation
45mMaking Containers Safer
30mUser namespaces with host-isolated UIDs/GIDs
57mNamespaces for Security