feat(sandbox): add Kubernetes user namespace isolation #983
Open
mrunalp wants to merge 1 commit intoNVIDIA:mainfrom
Open
feat(sandbox): add Kubernetes user namespace isolation #983mrunalp wants to merge 1 commit intoNVIDIA:mainfrom
mrunalp wants to merge 1 commit intoNVIDIA:mainfrom
Conversation
mrunalp
force-pushed
the
feat/kubernetes-user-namespaces
branch
from
8e24ef2 to
edc8e1e
Compare
drew
previously approved these changes
Apr 29, 2026
mrunalp
force-pushed
the
feat/kubernetes-user-namespaces
branch
from
edc8e1e to
3a22fa9
Compare
drew
previously approved these changes
Apr 30, 2026
mrunalp
force-pushed
the
feat/kubernetes-user-namespaces
branch
from
0ba2810 to
61d7d12
Compare
Collaborator
Author
|
@drew I had to rebase again to resolve merge conflicts. |
cgwalters
reviewed
Apr 30, 2026
drew
previously approved these changes
May 1, 2026
mrunalp
force-pushed
the
feat/kubernetes-user-namespaces
branch
2 times, most recently
from
74bedf2 to
86866b5
Compare
…lse) Add opt-in support for Kubernetes user namespace isolation on sandbox pods. When enabled, container UID 0 maps to an unprivileged host UID and capabilities become namespaced, providing defense-in-depth for the supervisor process. Configuration is two-layered: a cluster-wide default via OPENSHELL_ENABLE_USER_NAMESPACES (default false) and a per-sandbox override via the new `user_namespaces` field on SandboxTemplate. When user namespaces are active, the pod security context is extended with SETUID, SETGID, and DAC_READ_SEARCH capabilities to match the bounding-set requirements inside a user namespace. Introduces SandboxPodParams struct to replace long argument lists on sandbox_to_k8s_spec and sandbox_template_to_k8s. Validated end-to-end on OCP 4.22 (K8s 1.35.3, CRI-O 1.35, RHEL CoreOS, kernel 5.14) with full SSH tunnel and non-identity UID mapping.
mrunalp
force-pushed
the
feat/kubernetes-user-namespaces
branch
from
86866b5 to
d8b6786
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add opt-in Kubernetes user namespace isolation for sandbox pods. When enabled, container UID 0 maps to an unprivileged host UID and capabilities become namespaced, providing defense-in-depth against container escape vulnerabilities.
OPENSHELL_ENABLE_USER_NAMESPACES/ Helmserver.enableUserNamespaces(default off), with per-sandbox override viaSandboxTemplate.user_namespacesin the APISETUID,SETGID,DAC_READ_SEARCH) when user namespaces are active, matching the Podman driver's approachDirectoryOrCreatetoDirectoryRelated Issue
Fixes #982
Changes
Proto & config (3 files):
proto/openshell.proto— addoptional bool user_namespacestoSandboxTemplatecrates/openshell-core/src/config.rs— addenable_user_namespacestoConfigcrates/openshell-driver-kubernetes/src/config.rs— add field toKubernetesComputeConfigServer & driver wiring (4 files):
crates/openshell-server/src/cli.rs— add--enable-user-namespacesCLI argcrates/openshell-server/src/lib.rs— pass config to K8s drivercrates/openshell-server/src/compute/mod.rs— translateuser_namespaces→host_usersinbuild_platform_configcrates/openshell-driver-kubernetes/src/main.rs— add CLI arg for standalone driverK8s driver (1 file):
crates/openshell-driver-kubernetes/src/driver.rs— addplatform_config_boolhelper, setspec.hostUsers: false, extend capabilities conditionally, change hostPath type toDirectory, GPU warning, unit testsHelm (2 files):
deploy/helm/openshell/values.yaml— addenableUserNamespaces: falsedeploy/helm/openshell/templates/statefulset.yaml— wire env varDocs (4 files):
docs/security/best-practices.mdx— add User Namespace Isolation sectionarchitecture/kubernetes-user-namespaces.md— design doc with DinD limitation and Helm deployment guidearchitecture/kubernetes-user-namespaces-ocp-testing.md— step-by-step OCP reproduction guideTests (1 file):
e2e/rust/tests/user_namespaces.rs— e2e pod spec verificationTesting
cargo test -p openshell-driver-kubernetes— 26 tests pass (8 new for user namespaces)cargo test -p openshell-server --lib— server-side inversion test passesmise run e2e— 31/32 pass (1 pre-existing flaky failure unrelated to this change)user_namespacestest passes againstmise run cluster(verifies pod spec)0 → 3285581824)0 → 2437873664)MOUNT_ATTR_IDMAPfails on nested overlayfs (documented)Checklist
docs/security/best-practices.mdx)Open Items