cyber.hendryadrian.com
Interesting Stuff · wiz.io

How Kubernetes User Namespaces Can Reduce Container Escape Risks—and Their Limitations

· Original article ↗

Summary

Kubernetes v1.25’s alpha user namespaces can limit container-escape impact through UID remapping and safer privilege use, but kernel attack surface and workload compatibility limitations mean operators should assess fit and block unshare(CLONE_NEWUSER) with seccomp.

Key points

  • User namespaces map container UID 0 to a nonzero host UID, limiting access to host-owned files, devices, sockets, and kubelet configuration if a container process escapes.
  • The feature can improve pod isolation and reduce the need for powerful privileges such as SYS_ADMIN or NET_ADMIN.
  • Kubernetes user namespaces were alpha and not production-ready in the article; testing described was on GKE alpha clusters.
  • Creating a user namespace can expose additional kernel code paths; the article cites CVE-2022-0185 and recommends blocking unshare(CLONE_NEWUSER) with a seccomp profile.
  • Workloads using host-shared namespaces, requiring initial user-namespace access, or using unsupported shared volume types may be incompatible.
  • Wiz Research reported that in its investigated containerized environments, over 30% of pods used host-shared namespaces, 44% had problematic volumes, and 24.4% were privileged.

Article Details

Topic
Kubernetes Linux user namespaces and their security benefits, limitations, and workload compatibility

CVE

CVE-2022-0185Consider CVE-2022-0185. Exploiting this vulnerability requires a localized CAP_SYS_ADMIN granted automatically by userns, reflecting how a security feature can actually generate an insecurity at the kernel level.

Products

DockerAppendix A–Userns in Docker Google Kubernetes Engineare not production ready. In fact, the only place userns can be tested in managed clusters is Google Kubernetes Engine (GKE) alpha clusters. All testing described in this post occurred there.KubernetesKubernetes v1.25 introduced alpha support for Linux user namespaces (userns). This feature is touted as an additional isolation layer that improves host security and prevents many known container escape scenarios. LinuxKubernetes v1.25 introduced alpha support for Linux user namespaces (userns). This feature is touted as an additional isolation layer that improves host security and prevents many known container escape scenarios. 

Tools

gcsfusecommand: ["gcsfuse", "-o", "nonempty", "your-bucket-name", "/etc/letsencrypt"]OpenVPNAnother common scenario is connecting a pod to a VPN network. Popular services like OpenVPN require the NET_ADMIN capability to configure a pod's network settings. When isolated by a user namespace, a pod is unable to

Related Articles