Kubernetes v1.36: User Namespaces in Kubernetes are finally GA

Kubernetes v1.36 reaches User Namespaces GA, enabling rootless container security isolation.

• •User Namespaces prevent container root from accessing host root
• •Processes can run privileged capabilities (CAP_NET_ADMIN) within namespace when hostUsers: false
• •ID-mapped mounts (Linux 5.12+) translate UIDs/GIDs transparently at mount time
• •Implementation: simply set hostUsers: false in Pod spec without image changes
• •Feature resolves critical security gap after 6+ years of development

This summary was automatically generated by AI based on the original article and may not be fully accurate.