I’ve run into Debian’s kernel.unprivileged_userns_clone. And looking at this I wonder, “Are unprivileged containers really safer than the privileged ones?”
Having been shipping kernels with user namespaces enabled to millions of users (Ubuntu) for the past 7 years +, it’s not really been an issue.
It was a bit bumpy in the early days with user namespaces exposing some longstanding bugs, especially in VFS/mount handling. But we’ve not seen such issues in quite a while now.
2 Likes