User namespaces with host-isolated UIDs/GIDs
summary
Proposal converts kuid_t/kgid_t to 64-bit so high UIDs/GIDs can be host-isolated while preserving 32-bit userland view, and implements VFS ID-mapped mounts to let unmapped processes access persisted files. Prototype uses 11 kernel patches, demo shows unprivileged creation of isolated namespaces works but storage path currently fails in this build; patch set is surprisingly small, needs tests and fixes (root must have a real UID today) before merge.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 2:35Problems with current UID/GID mapping
- 5:46Proposed solution with 64-bit IDs
- 9:02Live demonstration
- 13:38Implementation details and patches
- 16:55Q&A and future work
related talks
42mWhat's New in the User Namespace
01h 03mLinux Namespaces for Fun and Isolation
54mUnderstanding user namespaces
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security
54mContainers unplugged: understanding user namespaces
47mLinux user namespaces: a blessing and a curse
57mNamespaces for Security
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both