Maxime Coquerel • 6/18/2025

User Namespaces in Kubernetes: Perspectives on Isolation and Escape

This technical article examines Kubernetes User Namespaces, a feature for improving pod isolation by mapping container users to non-root host UIDs. It details the core concept and then provides an offensive security analysis, exploring potential attack surfaces like privilege escalation via misconfigured mappings, kernel exploits, anti-forensics evasion, and shared resource attacks.

0 comments

#privilege escalation #linux kernel #Kubernetes