Usernetes is a rootless Kubernetes implementation designed to enhance security by isolating user privileges within user namespaces, preventing attackers from gaining root access even if they exploit pods or kubelet APIs. The project, initiated in 2018, integrates technologies like Kubernetes, Docker, and Podman and offers improvements in multi-node networking and host dependency management in its second generation, which began in 2023. Notable implementations include Kind, Minikube, and K3s, which support the rootless model with various configurations.

1. Usernetes Generation 2
Kubernetes in Rootless Docker
https://github.com/rootless-containers/usernetes
Akihiro Suda, NTT
CNCF TAG-Runtime Meeting (Oct 26, 2023)

2. • Rootless Kubernetes
– Even if an attacker has escaped from a Pod, or gained an access to kubelet
API, the attacker still cannot gain the root privilege of the node
• Implemented by putting kubelet, CRI, OCI, CNI, etc. in a user
namespace
– UserNS: Linux kernel’s feature that maps a non-root user to a fake root
(the root privilege is limited inside the namespace)
• Multi-node networking is possible with VXLAN
2
Usernetes github.com/rootless-containers/usernetes

3. • Began in 2018
– As old as Rootless Docker (pre-release at that time) and Rootless Podman
• The changes to Kubernetes was merged in Kubernetes v1.22
(Aug 2021)
– Feature gate: “KubeletInUserNamespace” (Alpha)
• The feature gate was also adopted by:
– kind (with Rootless Docker or Rootless Podman)
– Minikube (with Rootless Docker or Rootless Podman)
– k3s
3
History

4. Gen 1 (2018-2023) Gen 2 (2023-)
Host dependency RootlessKit Rootless Docker,
Rootless Podman, or
Rootless nerdctl
(contaiNERD CTL)
Supports kubeadm No Yes
Supports multi-node Yes, but practically No,
due to complexity
Yes
Supports hostPath
volumes
Yes Yes, for most paths,
but needs an extra config
4
Usernetes Gen 1 vs Gen 2
”The hard way”
Similar to `kind` and minikube,
but supports real multi-node

5. 5
Usage
# Bootstrap the first node
make up
make kubeadm-init
make install-flannel
# Enable kubectl
make kubeconfig
export KUBECONFIG=$(pwd)/kubeconfig
kubectl get pods -A
# Multi-node
make join-command
scp join-command another-host:~/usernetes
ssh another-host make -C ~/usernetes up kubeadm-join