What's New in the User Namespace
summary
User namespaces exist for ~9 years but remain uncommon; the kernel now offers VFS idmapped mounts (landed in recent kernels for ext4, xfs, vfat, btrfs, f2fs and overlay support growing) which solves shared layered-root problems that required rewriting images, replacing the brittle overlay approach shiftfs that caused cache and ioctl bugs. Typical containers map 65,536 uids/gids; tools are unshare plus newuidmap/newgidmap. New work includes IMA namespacing, a tracing namespace, and host-side system-call interception to mediate privileged actions like mounting, BPF and controlled module loads.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:51What are user namespaces?
- 5:09Common setup
- 9:10Filesystem handling
- 10:24The problem
- 18:22VFS idmap shifting
- 21:16New namespaces
- 22:25Integrity Measurements (IMA)
- 23:13Tracing
- 26:36Restricting the user namespace
- 29:20LSM hook
- 30:51System call interception
- 32:47Trusted resources
- 35:33Trusted workloads
- 36:29Conclusion
- 41:03Questions?
related talks
54mUnderstanding user namespaces
30mUser namespaces with host-isolated UIDs/GIDs
47mLinux user namespaces: a blessing and a curse
54mContainers unplugged: understanding user namespaces
01h 03mLinux Namespaces for Fun and Isolation
57mNamespaces for Security
29mFilesystem mounts in user namespaces
39mLinux User Namespaces: A Blessing and a Curse