@@ -50,35 +50,22 @@ In addition, the container runtime and its underlying OCI runtime must support
50
50
user namespaces. The following OCI runtimes offer support:
51
51
52
52
* [ crun] ( http://github.com/containers/crun ) version 1.9 or greater (it's recommend version 1.13+).
53
+ * [ runc] ( http://github.com/opencontainers/runc ) version 1.2 or greater
53
54
54
- <!-- ideally, update this if a newer minor release of runc comes out, whether or not it includes the idmap support -->
55
55
{{< note >}}
56
- Many OCI runtimes do not include the support needed for using user namespaces in
56
+ Some OCI runtimes do not include the support needed for using user namespaces in
57
57
Linux pods. If you use a managed Kubernetes, or have downloaded it from packages
58
- and set it up, it's likely that nodes in your cluster use a runtime that doesn't
59
- include this support. For example, the most widely used OCI runtime is ` runc ` ,
60
- and version ` 1.1.z ` of runc doesn't support all the features needed by the
61
- Kubernetes implementation of user namespaces.
62
-
63
- If there is a newer release of runc than 1.1 available for use, check its
64
- documentation and release notes for compatibility (look for idmap mounts support
65
- in particular, because that is the missing feature).
58
+ and set it up, it's possible that nodes in your cluster use a runtime that doesn't
59
+ include this support.
66
60
{{< /note >}}
67
61
68
62
To use user namespaces with Kubernetes, you also need to use a CRI
69
63
{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}
70
64
to use this feature with Kubernetes pods:
71
65
66
+ * containerd: version 2.0 (and later) supports user namespaces for containers.
72
67
* CRI-O: version 1.25 (and later) supports user namespaces for containers.
73
68
74
- containerd v1.7 is not compatible with the userns support in Kubernetes v1.27 to v{{< skew latestVersion >}}.
75
- Kubernetes v1.25 and v1.26 used an earlier implementation that ** is** compatible with containerd v1.7,
76
- in terms of userns support.
77
- If you are using a version of Kubernetes other than {{< skew currentVersion >}},
78
- check the documentation for that version of Kubernetes for the most relevant information.
79
- If there is a newer release of containerd than v1.7 available for use, also check the containerd
80
- documentation for compatibility information.
81
-
82
69
You can see the status of user namespaces support in cri-dockerd tracked in an [ issue] [ CRI-dockerd-issue ]
83
70
on GitHub.
84
71
0 commit comments