News › security
By Zayden R., September 5, 2026
Kubernetes v1.37 has promoted KubeletInUserNamespace, also known as rootless mode, to beta status. This update allows node components to run as non-root users, mitigating container-breakout vulnerabilities.
Kubernetes v1.37 has rolled out a significant security enhancement by promoting the KubeletInUserNamespace feature, commonly referred to as rootless mode, to beta status. This development is crucial for engineers focused on safeguarding their clusters against potential vulnerabilities that can arise from node components running with root privileges.
Initially introduced as an experimental feature in 2018 and later integrated as an alpha feature in Kubernetes v1.22, rootless mode allows all node components, including kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy, to operate without root access on the host. This is achieved using Linux user namespaces, offering a layer of security by limiting the potential damage in the event of a container breakout.
The necessity for such a feature stems from historical vulnerabilities like CVE-2022-0811, CVE-2023-27561, and CVE-2024-10220, which have demonstrated how node components can be exploited to gain unauthorized root access. By confining these components within a non-root user namespace, the risk of compromising the host's integrity is significantly reduced. Importantly, this setup prevents attackers from making undetected changes to the kernel or critical system components.
While rootless mode enhances security, it is not a standalone solution. It should be implemented alongside traditional hardening measures, such as seccomp, to further restrict system call access. This is particularly relevant for production clusters and shared environments like high-performance computing systems, where the risk of container-breakout vulnerabilities is higher.
The promotion of rootless mode to beta signifies Kubernetes' ongoing commitment to evolving its security features. Engineers managing Kubernetes clusters should consider enabling this feature to bolster their systems' defenses against potential threats.