Not running containers as root is an essential security best practice as it prevents the dangerous consequences of a compromised runtime. Usernetes is a well-known project that implements Kubernetes without root privileges. Its original version (Generation 1 or “Gen1”) appeared in 2018 and later became a part of upstream Kubernetes (alpha feature in v1.22, under the KubeletInUserNamespace feature gate).

The latest version of Usernetes (“Gen2”) emerged in 2023 and changed in many ways:
- Relies on Rootless Docker, Rootless Podman, or Rootless nerdctl to deploy a Kubernetes cluster inside. (Instead of RootlessKit.)
- Supports kubeadm.
- Supports multi-node setups.

Briefly, if Usernetes Gen1 seemed complicated (like “Kubernetes The Hard Way”), its Gen2 is akin to Rootless kind and Rootless minikube, yet you can deploy a cluster with multiple hosts.

Ubuntu 22.04, Rocky Linux 9, and AlmaLinux 9 are supported as host operating systems for Usernetes.

▶️ GitHub repo: https://github.com/rootless-containers/usernetes
📺 A recent talk by the project’s author Akihiro Suda, which features the Usernetes Gen2 demonstration.
📷 Slides about Usernetes Gen2 at recent Container Plumbing Days.

#tools #security