World map

 

BM

World K6: Guards

User namespaces

You will learn: how one line lets an app be root inside its pod, and nobody on the node.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

An old app insists on running as root inside its box. Your restricted zone says no. Are you stuck?

Watch

In its own user namespace: Boss inside the stall, nobody outside: root in the pod is a plain user on the node., the cook is boss inside the stall. Outside, the node sees a nobody. One line turns it on. Tap it.

Tap the line that gives the pod its own users.

0 of 1 found

Try it

A user-namespace pod cannot share the node’s other spaces. Sort each setting.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      Zone kedai enforces restricted. A pod sets hostUsers: false and runAsUser: 0, plus every other lock. Does the guard let it in?

      Try it

      Mei wrote the line, but the API server refuses it. Fix it.

      Fix the manifest, then press Apply.

      legacy.yaml11 lines

      Check

      Does a user namespace need this? Swipe each one.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Linux nodes with kernel 6.3 or newer

      You did it!

      You can now give a root-only app its own user namespace.

      Go deeper (optional)

      Where the story breaks: real guards use judgement. Kubernetes gates only follow written rules. RBAC has no “deny” list at all. The gates check requests, not what a container does later. securityContext and the Linux kernel guard that part. A logbook only helps if someone reads it.

      Real mission

      2. kubectl apply -f legacy.yaml
      3. kubectl exec legacy -- id

      0 of 3 steps done · Your ticks are saved.