Skip to content

Commit b127822

Browse files
committed
content: update UserNS document for runc v1.2 and containerd v2.0
Refs: - opencontainers/runc PR 3717 - opencontainers/runc PR 3993 - containerd/containerd PR 8803 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
1 parent 76c9b17 commit b127822

File tree

1 file changed

+5
-18
lines changed

1 file changed

+5
-18
lines changed

content/en/docs/concepts/workloads/pods/user-namespaces.md

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -50,35 +50,22 @@ In addition, the container runtime and its underlying OCI runtime must support
5050
user namespaces. The following OCI runtimes offer support:
5151

5252
* [crun](http://github.com/containers/crun) version 1.9 or greater (it's recommend version 1.13+).
53+
* [runc](http://github.com/opencontainers/runc) version 1.2 or greater
5354

54-
<!-- ideally, update this if a newer minor release of runc comes out, whether or not it includes the idmap support -->
5555
{{< note >}}
56-
Many OCI runtimes do not include the support needed for using user namespaces in
56+
Some OCI runtimes do not include the support needed for using user namespaces in
5757
Linux pods. If you use a managed Kubernetes, or have downloaded it from packages
58-
and set it up, it's likely that nodes in your cluster use a runtime that doesn't
59-
include this support. For example, the most widely used OCI runtime is `runc`,
60-
and version `1.1.z` of runc doesn't support all the features needed by the
61-
Kubernetes implementation of user namespaces.
62-
63-
If there is a newer release of runc than 1.1 available for use, check its
64-
documentation and release notes for compatibility (look for idmap mounts support
65-
in particular, because that is the missing feature).
58+
and set it up, it's possible that nodes in your cluster use a runtime that doesn't
59+
include this support.
6660
{{< /note >}}
6761

6862
To use user namespaces with Kubernetes, you also need to use a CRI
6963
{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}
7064
to use this feature with Kubernetes pods:
7165

66+
* containerd: version 2.0 (and later) supports user namespaces for containers.
7267
* CRI-O: version 1.25 (and later) supports user namespaces for containers.
7368

74-
containerd v1.7 is not compatible with the userns support in Kubernetes v1.27 to v{{< skew latestVersion >}}.
75-
Kubernetes v1.25 and v1.26 used an earlier implementation that **is** compatible with containerd v1.7,
76-
in terms of userns support.
77-
If you are using a version of Kubernetes other than {{< skew currentVersion >}},
78-
check the documentation for that version of Kubernetes for the most relevant information.
79-
If there is a newer release of containerd than v1.7 available for use, also check the containerd
80-
documentation for compatibility information.
81-
8269
You can see the status of user namespaces support in cri-dockerd tracked in an [issue][CRI-dockerd-issue]
8370
on GitHub.
8471

0 commit comments

Comments
 (0)