Akihiro Suda
2860fbf1ad
Enables support for running kubelet in a user namespace. The user namespace has to be created before running kubelet. All the node components such as CRI need to be running in the same user namespace. - Tracking issue: kubernetes/enhancements issue 2033 - KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless - Implementation: kubernetes/kubernetes PR 92863 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
929 B
929 B
title, id, date, full_link, short_description, aka, tags
| title | id | date | full_link | short_description | aka | tags | |
|---|---|---|---|---|---|---|---|
| user namespace | userns | 2021-07-13 | https://man7.org/linux/man-pages/man7/user_namespaces.7.html | A Linux kernel feature to emulate superuser privilege for unprivileged users. |
|
A kernel feature to emulate root. Used for "rootless containers".
User namespaces are a Linux kernel feature that allows a non-root user to emulate superuser ("root") privileges, for example in order to run containers without being a superuser outside the container.
User namespace is effective for mitigating damage of potential container break-out attacks.
In the context of user namespaces, the namespace is a Linux kernel feature, and not a {{< glossary_tooltip text="namespace" term_id="namespace" >}} in the Kubernetes sense of the term.