8 Key Milestones with Kubernetes User Namespaces in v1.36 – Now GA

After years of development and countless contributions from the container runtime community, Kubernetes v1.36 finally brings User Namespaces to General Availability (GA). This Linux-only feature marks a turning point for rootless security isolation, enabling pods to run with reduced host privileges while still performing privileged operations inside the container. In this listicle, we explore eight essential aspects of this feature—from the core problem it solves to the kernel magic that makes it possible, and how you can start using it today.

1. The Long-Awaited GA Milestone

User Namespaces support has been in the making for several releases, reaching its stable and production-ready state only in Kubernetes v1.36. For those deeply involved with low-level container runtimes and rootless technologies, this is a monumental achievement. The feature finally allows administrators to enforce true “rootless” security isolation across Kubernetes workloads without sacrificing performance or requiring complex workarounds. This GA status signals that the Kubernetes community has thoroughly tested the feature, resolved compatibility issues, and integrated it with the broader ecosystem—making it safe and reliable for production environments.

2. The Core Problem: Why UID 0 Inside a Container Is Dangerous

A process running as root (UID 0) inside a container is seen as root by the host kernel as well. This means that if an attacker manages to break out of the container—through a kernel vulnerability, a misconfigured mount, or even a privileged syscall—they immediately gain root privileges on the host. Traditional security measures (e.g., seccomp, AppArmor, restricted capabilities) mitigate some risks but never change the underlying identity of the process. The process still holds certain root-like powers. User Namespaces solve this by mapping the container’s UID 0 to an unprivileged UID on the host, so even if an escape occurs, the attacker inherits a low-privilege identity.

3. ID-Mapped Mounts: The Engine That Makes It All Possible

One of the biggest blockers to adopting User Namespaces was volume ownership. Previously, if you mapped a container to a high UID range, the kubelet had to recursively change ownership of every file in attached volumes—a slow, expensive chown operation that could cripple startup times for large persistent volumes. The breakthrough came with Linux kernel 5.12’s ID-mapped mounts (refined in later versions). Instead of rewriting file ownership on disk, the kernel performs an instant, O(1) translation at mount time. The container sees files owned by UID 0, while on disk the original owner remains unchanged. This eliminates the need for any chown and makes volume mounting with User Namespaces both efficient and transparent.

4. How to Use User Namespaces in v1.36

Enabling User Namespaces in your pods is remarkably simple. All you need to do is set hostUsers: false in the Pod spec. No modifications to container images, no additional daemon configurations, and no complex YAML changes. The API has remained consistent since the alpha phase. For example:

apiVersion: v1
kind: Pod
metadata:
  name: isolated-workload
spec:
  hostUsers: false
  containers:
  - name: app
    image: fedora:42
    securityContext:
      runAsUser: 0

That’s it. Kubernetes automatically sets up the user namespace mapping and ID-mapped mounts for all volumes. You can continue to use runAsUser: 0 inside the container—it will be remapped to an unprivileged range on the host.

5. Running Privileged Workloads Without Host Privilege

A critical pattern enabled by this feature is the ability to run workloads that require root-like capabilities (for example, CAP_NET_ADMIN) while still being confined inside a user namespace. When hostUsers: false is set, all capabilities become namespaced—they grant administrative power only over container-local resources, such as network interfaces visible inside the pod. This means you can now run network troubleshooting tools, VPN clients, or firewall managers without exposing the host to risks. Previously, such use cases required a fully privileged container, which was a significant security concern. User Namespaces eliminate that trade-off.

6. Mitigating High-Severity CVEs

User Namespaces are not just a theoretical improvement; they directly mitigate real-world vulnerabilities. Several Common Vulnerabilities and Exposures (CVEs) rated HIGH or CRITICAL—such as container escape exploits that rely on breaking out of a user namespace—are rendered ineffective when containers run inside a non-host user namespace. Even if a vulnerability allows the process to exit its container boundaries, the attacker remains unprivileged on the host. This security posture is already being validated by community demos and penetration tests. For a deeper dive, refer to previous blog posts on User Namespaces alpha, stateful pods in alpha, beta, and the enabled-by-default phase.

7. Implications for Stateful Workloads and Persistent Volumes

Because ID-mapped mounts work transparently, stateful applications (like databases, message queues, or content management systems) can now benefit from User Namespaces without any change to their persistent volume claims. The kernel handles the UID/GID remapping on every mount, so files previously owned by a specific host user ID are perceived as owned by UID 0 inside the pod. This makes it safe to run such workloads with hostUsers: false while preserving existing permissions on disk. However, note that if you need to share volumes across pods with different user namespace mappings, you must ensure the underlying file ownership is compatible—or rely on the new remapping mechanism to handle it.

8. Getting Involved and Future Directions

The Kubernetes community welcomes contributions to further harden and extend User Namespaces. Current areas of focus include better integration with container runtimes (containerd, CRI-O), support for additional volume types, and performance optimizations for large-scale clusters. If you are interested in contributing, consider joining the SIG Node meetings, testing the feature on v1.36 clusters, and providing feedback. The roadmap also includes exploring User Namespaces for system daemons and extending the feature to non-Linux platforms (though the kernel dependency means this is a longer-term goal). To stay updated, follow the official Kubernetes blog and the User Namespace GA announcement.

Conclusion

User Namespaces in Kubernetes v1.36 represent a giant leap forward for container security. By decoupling a container’s internal root identity from the host’s root user, and by leveraging kernel ID-mapped mounts to handle volumes efficiently, this feature enables unprecedented levels of isolation without sacrificing performance or ease of use. Whether you are running a small development cluster or a multi-tenant production environment, enabling hostUsers: false should now be considered a best practice. The long wait for GA has paid off—now it’s time to put User Namespaces to work.