Run As “Root”, Not Root: User Namespaces In K8s
Talkat KubeCon + CloudNativeCon North America 2022 · on Thursday, 2022-10-27· at 15:25· Virtual Platform Only·
summary
A single PodSpec boolean hostUsers: false isolates container UIDs via Linux user namespaces so root in-container maps to uid 0 → uid 65536 on the host, limiting damage from escapes and mitigating CVE‑2019‑5736 and the 2022 0.492 exploit shown in the demo. Requires Kubernetes 1.25 and runtime support (cri‑o has patches, containerd pending, Docker usable today). Current limits: only stateless or lifecycle‑tied volumes, group‑writable mounts for secrets, and kubelet‑owned files remain root on the host.
AI-written summary · about
chapters (8)
- 0:00User namespaces in Kubernetes
- 1:43Running containers as root
- 4:12User namespace isolation
- 7:45Enabling user namespaces
- 8:28Requirements and limitations
- 11:59Live demo
- 19:12Vulnerability mitigation
- 21:40Closing remarks
related talks
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
35mThe Reality of Rootless Containers
21mMaking Kubernetes Safer with User Namespaces
38mUnderstanding root inside and outside a container
32mRoot Without Risk: A Decade-Long Quest for True Container Isolation
31mTowards unprivileged container builds
39mLinux User Namespaces: A Blessing and a Curse