Uploaded July 2026 | Updated September 2026, 2 weeks ago

---

Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Yokohama, Japan (29-30 July, 2026), and Shanghai, China (8-9 September, 2026) Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io

Root Without Risk: A Decade-Long Quest for True Container Isolation - Sumir Broota, Broota Enterprise

Kubernetes has long struggled with safe container isolation where `root` in a pod meant `root` on the node. This session shows how KEP‑127 and user namespaces finally make root inside a container harmless.

Real scenario: Your container needs CAP_SYS_ADMIN for FUSE mounts. An exploit succeeds. Without user namespaces: attacker = root on node, full cluster access. With user namespaces: attacker = UID 65536 - relatively powerless.

This talk chronicles the 9+ year journey mapping your pods "root" to an unprivileged nobody on the host.

Why it took 9 years:
- Early attempts (2016) failed-no kernel support
- v1.25-1.28: Three alpha rewrites
- v1.27: idmap mounts breakthrough
- v1.30: off-by-default Beta after CRI overhauls
- v1.33: Default beta-production-ready
- v1.34: Observability (metrics added)

What you'll learn:
✓ Live code walkthrough: kubelet → CRI → runc UID remapping
✓ Demos: container breakout attempts CVE-2024-21626 AKA Leaky Vessel patched
✓ Practical deployment patterns