Kubernetes finally lands user namespace support, but shared kernel problem remains

Kubernetes 1.36 adds pod user namespace support, letting root inside a pod map to an unprivileged host UID when hostUsers is false.

This can reduce the impact of some privilege-escalation and container-escape CVEs by limiting what a breakout can do on the host.

But user namespaces do not isolate the Linux kernel, so shared-kernel vulnerabilities remain a serious risk in multi-tenant clusters.

The feature improves pod isolation, but operators should not treat it as full protection against kernel-level exploits.