Akihiro Suda
2860fbf1ad
Enables support for running kubelet in a user namespace. The user namespace has to be created before running kubelet. All the node components such as CRI need to be running in the same user namespace. - Tracking issue: kubernetes/enhancements issue 2033 - KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless - Implementation: kubernetes/kubernetes PR 92863 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
29 lines
929 B
Markdown
29 lines
929 B
Markdown
---
|
|
title: user namespace
|
|
id: userns
|
|
date: 2021-07-13
|
|
full_link: https://man7.org/linux/man-pages/man7/user_namespaces.7.html
|
|
short_description: >
|
|
A Linux kernel feature to emulate superuser privilege for unprivileged users.
|
|
|
|
aka:
|
|
tags:
|
|
- security
|
|
---
|
|
|
|
A kernel feature to emulate root. Used for "rootless containers".
|
|
|
|
<!--more-->
|
|
|
|
User namespaces are a Linux kernel feature that allows a non-root user to
|
|
emulate superuser ("root") privileges,
|
|
for example in order to run containers without being a superuser outside the container.
|
|
|
|
User namespace is effective for mitigating damage of potential container break-out attacks.
|
|
|
|
In the context of user namespaces, the namespace is a Linux kernel feature, and not a
|
|
{{< glossary_tooltip text="namespace" term_id="namespace" >}} in the Kubernetes sense
|
|
of the term.
|
|
|
|
<!-- TODO: https://kinvolk.io/blog/2020/12/improving-kubernetes-and-container-security-with-user-namespaces/ -->
|