Kubernetes finally lands user namespace support, but shared kernel problem remains

Kubernetes v1.36 shipped user namespace support as a GA feature, allowing container root processes to be remapped to unprivileged host UIDs. While this mitigates certain privilege-escalation CVEs and reduces lateral movement between pods, it does not address the fundamental shared-kernel threat model. Every container on a node still shares the same Linux kernel, meaning a kernel exploit bypasses user namespace protections entirely. The author argues the official announcement overstates the security gains by conflating UID remapping with true isolation. The piece also highlights AI-assisted exploit tools like Anthropic's Mythos as accelerating the threat timeline for kernel vulnerabilities. Hardware-level virtualization — where each workload gets its own isolated kernel via a hypervisor — is presented as the only architecture that genuinely eliminates the shared-kernel attack surface, with Edera (the post's sponsor) cited as an example.