Isolate the Users! Supporting User Namespaces in K8s for Increased Security

This talk explains how Linux user namespaces map container user and group IDs so that a process running as root in a container runs as a non-root user on the host. It covers efforts to support user namespaces in Kubernetes, including volume-related challenges and approaches such as shiftfs and idmapped mounts.