CloudNativeSecurityCon North America 2024

Kubernetes has not made use of user namespaces, despite the fact that Linux has supported them for around 10 years. This is changing and in Kubernetes 1.30 user namespaces will become a beta feature. Users will begin to benefit from the increased security and flexibility they offer if they adopt several simple practices. This presentation will introduce the concepts, such as Linux namespaces, that make containers possible on Linux. It will explain what user namespaces are, and demonstrate how they can help mitigate a recently discovered vulnerability in the container ecosystem. Finally, it will demonstrate the flexibility of user namespaces through running Docker inside a container without using "privileged” mode, as some common "Docker-in-Docker" approaches do.