> ## Content Index
> Fetch the complete content index at: https://www.stirup.si/llms.txt
> Use this file to discover other available public pages before exploring further.

# Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta
- URL: https://www.stirup.si/kubernetes-v1-37-kubeletinusernamespace-aka-rootless-mode-graduates-to-58cd2f8e/
- Published: 2026-10-12T04:57:11.000Z
- Updated: 2026-10-12T04:57:11.000Z
- Description: Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta, allowing node components to run as non-root users within Linux user namespaces. This change aims to mitigate container-breakout vulnerabilities and improve security in production and shared environments.
- Author: Satish Das
- Tags: Infrastructure, Stirup Research

## Overview of KubeletInUserNamespace in Kubernetes v1.37

Kubernetes v1.37 marks a significant milestone in its security evolution by promoting the KubeletInUserNamespace feature gate to beta. This feature enables Kubernetes node components—such as kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy—to operate within Linux user namespaces, effectively running as non-root users on the host. This mode is commonly referred to as 'rootless mode.' The initiative, which began as an experiment in 2018, was first introduced as an alpha feature in Kubernetes v1.22 (2021) through Kubernetes Enhancement Proposal KEP-2033.

This feature should not be confused with user namespaces for pods, which are managed via the UserNamespacesSupport feature gate (GA since v1.36). While both features utilize user namespaces, the former applies to pods, and the latter to node components. These two capabilities are complementary and can be used together to achieve nested Kubernetes environments without requiring full privileged access.

## Security Implications and Use Cases

The primary motivation for running node components in user namespaces is to reduce the risk of container-breakout vulnerabilities that could lead to full root compromise on the host. Historical examples include CVE-2022-0811, CVE-2023-27561, and others, which have demonstrated how vulnerabilities in components like CRI-O, runc, and kubelet could allow arbitrary code execution as root. By confining these components to a non-root user namespace, the potential damage is limited to the user's account, and the host's integrity is better preserved.

Use cases for this feature span a variety of environments. In production clusters, it helps mitigate risks from container-breakout vulnerabilities. Shared machines, such as those used in high-performance computing (HPC), benefit from allowing users to deploy Kubernetes without requiring root privileges. Laptops and AI sandboxes can also leverage this feature to isolate local clusters from the host system, preventing accidental or malicious configuration changes. Additionally, nested Kubernetes environments (Kubernetes-in-Kubernetes) can be created using user namespaces, offering stricter isolation than traditional Kubernetes API namespaces.

## Implementation and Compatibility

The KubeletInUserNamespace feature gate itself is relatively straightforward, primarily allowing the kubelet to ignore certain permission errors when setting sysctl values or accessing kernel messages. However, the user namespace must be created outside of Kubernetes, typically using tools like Rootless Docker, nerdctl, or Podman. This requirement introduces some compatibility considerations, particularly with specific CNI and CSI drivers that may not yet support user namespaces.

With the promotion to beta, the feature gate is now enabled by default, though it does not automatically activate rootless mode for existing clusters. Cluster administrators can now use the `runningInUserNamespace` property reported by `kubectl get nodes -o yaml` to label or taint nodes, ensuring that workloads requiring real root access are not scheduled on rootless nodes.

## Future Directions and Community Involvement

The Kubernetes project plans to graduate this feature to General Availability (GA) in a future release, depending on feedback and adoption. Several related improvements have already been made, including support for idmapped tmpfs in Linux kernel v6.3, default enabling of the UserNamespacesSupport feature gate in Kubernetes v1.33, and writable cgroups support in containerd v2.1\. These enhancements enable more robust nested Kubernetes environments.

Users interested in experimenting with this feature can use tools like `kind`, `minikube`, `Usernetes`, or `k3s` to deploy rootless Kubernetes clusters. Each tool has its own setup and configuration requirements, and documentation is available for further guidance.

Community involvement remains crucial for the continued development and refinement of this feature. Contributions and feedback are welcome, and interested parties can engage with the Node Special Interest Group (SIG Node) or participate in public Slack channels for discussions.

**Source:** [Kubernetes](https://kubernetes.io/blog/2026/09/04/kubernetes-v1-37-rootless-beta/?ref=stirup.si). Analysis based on publicly available information; no hands-on testing is claimed.