Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. This enables all node components (kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy) to run as a non-root user on the host, using a Linux user namespace, a technique commonly referred to as rootless mode.
- The work began as an experiment in 2018 and was merged into Kubernetes v1.22 (2021) as an alpha feature under Kubernetes Enhancement Proposal KEP-2033.
- The feature should not be confused with host-level pod user namespaces (hostUsers: false with UserNamespacesSupport, GA since v1.36), which place pods in user namespaces but keep node components running as root.
WHAT ROOTLESS MODE MEANS FOR NODE COMPONENTS
Enabling this feature allows node components to operate without root privileges on the host by leveraging a Linux user namespace. This approach is intended to reduce the risk that a broken or compromised container could grant root access to the host. The same user namespace can be nested with other Kubernetes configurations in supported environments. TechStaged has also covered Kubernetes v1.37 GA: Storage Version Migration Enabled by Default.
- Rootless mode is distinct from pod-level user namespaces; the two features do not conflict and can be used together to nest Kubernetes inside Kubernetes without granting privileged access.
WHY RUNNING NODE COMPONENTS IN A USER NAMESPACE MATTERS
Running node components in a user namespace confines potential container-breakout damage to a non-root account on the host. This limits the attacker’s ability to alter kernel code, bootloaders, or firmware compared to full root access. Several historical CVEs are cited as examples of risks that such isolation aims to mitigate, including issues related to CRI-O, runc, and kubelet in various scenarios.
- CVE-2022-0811 (cr8escape): CRI-O could be tricked into setting arbitrary sysctls, potentially leading to root access on the host.
- CVE-2023-27561: runc could bypass masked paths of a container via a volume mount race, exposing host procfs files.
- CVE-2024-10220: kubelet could execute arbitrary commands as root via gitRepo volumes.
- CVE-2025-31133: runc could be tricked into bind-mounting attacker-controlled paths to host procfs files.
- CVE-2026-53488: containerd could be tricked into executing arbitrary commands via crafted labels in a container image.
STATUS, DEFAULTS, AND HOW TO OBSERVE IN YOUR CLUSTER
The KubeletInUserNamespace feature gate is now enabled by default, but enabling the gate does not automatically place the kubelet inside a user namespace. Existing rootful clusters remain unaffected. Administrators can check whether nodes are running in a user namespace using a cluster-wide indicator.
- kubectl get nodes -o yaml reports the runningInUserNamespace property to indicate whether a node is in a user namespace.
- For Kubernetes' CI/CD testing, the node conformance end-to-end tests now run on a rootless cluster (ci-kubernetes-e2e-kind-rootless).
NESTING KUBERNETES AND HOW TO RUN ROOTLESS CLUSTERS
These developments enable scenarios where Kubernetes runs inside Kubernetes (Kubernetes-in-Kubernetes) with hostUsers: false. Several tooling and project efforts support rootless configurations, including kind and minikube, which can run clusters in rootless contexts with compatible runtimes and kernel configurations.
Other projects such as Usernetes and k3s also support rootless modes, and there are ongoing discussions about simplifying Kubernetes-in-Kubernetes with related KEPs.
- Kind can be used to run rootless clusters in various environments (rootless Docker, rootless nerdctl, or rootless Podman).
- Minikube supports running clusters in rootless contexts.
- Usernetes is a distribution of rootless Kubernetes and experimental Kubernetes-in-Kubernetes mode.
- k3s also offers rootless operation without requiring external runtimes.
WHAT HAPPENS NEXT AND BROADER CONTEXT
Outside of the immediate beta promotion, improvements span kernel, container tooling, and default feature gates that influence how rootless configurations are adopted in production and development environments. The Kubernetes project indicates that the feature may graduate to General Availability in a future release and welcomes feedback from users and contributors.
- Linux kernel v6.3 introduced idmapped tmpfs support (2023).
- Kubernetes v1.33 (2025) enabled the UserNamespacesSupport feature gate by default, allowing hostUsers: false pod namespaces.
- containerd v2.1 (2025) added support for writable cgroups.
- The nested Kubernetes approach with hostUsers: false remains a strategic option for certain deployment models, including Kubernetes-in-Kubernetes with rootless nodes.
RELATED COVERAGE
SOURCES
- Kubernetes Blog: Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta Published · Primary source
