Should You Disable Unprivileged User Namespaces on Your Linux Servers?

Should You Disable Unprivileged User Namespaces on Your Linux Servers?

One Linux security setting worth checking before the next kernel vulnerability comes along

Between the Clouds Newsletter

Oct 31

One thing that caught my attention with the recent Linux security vulnerabilities is the role that a specific underlying component of Linux comes into play, unprivileged user namespaces. This is one of those Linux features that many of us probably have enabled and don’t really give a lot of thought to. But, should we actually have this enabled on our Linux servers? I think this is a good question to ask. Especially with the number of Ubuntu and Debian hosts that many of us have running in the home lab for Docker, Kubernetes, etc. Let’s look at what this setting is and when you might want to disable it.

What are unprivileged user namespaces?

In case you haven’t heard of these, Linux user namespaces allow processes to have their own mappings of user and group IDs. This is useful for doing things like isolating processes and is one of the technologies that makes things like rootless Docker and Podman something we can do.

For instance, a process might think it is running as root inside its own namespace. But this doesn’t mean it has root privileges on the actual Linux host.

This is pretty cool functionality and definitely something that is useful for security. However, the double edged sword is this also allows unprivileged processes to interact with some kernel functionality that they wouldn’t have access otherwise. And, this is where things can get interesting when it comes to vulnerabilities.

The recently disclosed ZDI-CAN-33367 networking vulnerability is one example. This is where the exploit makes use of unprivileged user namespaces.

Check what you actually have enabled

One of the first things I would do is check this setting on your Ubuntu and Debian servers.

You can use the command below:

sysctl kernel.unprivileged_userns_clone

If it returns 1, unprivileged user namespace creation is enabled. Also, you can check the limit that is configured for user namespaces:

sysctl user.max_user_namespaces

A value greater than zero means the configured namespace limit allows their creation, but there may be other security restrictions in place as well. So, does this mean your Linux server is vulnerable just because these are enabled? No, that isn’t always the case.

There are other requirements for the exploit to be pulled off, and you may already have an updated kernel with the fix included.

Should you just turn them off?

It might be tempting for us to think that we just need to disable unprivileged user namespaces our Linux servers in the home lab. But, this could actually break things if we aren’t careful.

One of the things that may break is if you are running rootless Docker or Podman. For example, these depend on user namespaces. Some app sandboxing and other build tools also can need this to be enabled.

For a traditional Linux server running a few services that don’t need this functionality, it may make sense, but you just need to make sure you test thoroughly.

You can test disabling it with the command:

sudo sysctl -w user.max_user_namespaces=0

Before you do this though, I would make sure you have console access to the server and know which apps are running. If something stops working, you can just revert the change to the value you had earlier.

Also, I would check the application logs afterward and make sure everything continues to work with your apps. Keep in mind this setting isn’t persistent by itself. A reboot or another configuration mechanism may revert it back to the previous value.

And, there is another distinction worth making here. Disabling user namespaces doesn’t actually patch the kernel vulnerability. I would much rather get the vulnerability patched that just a simple mitigation.

Wrapping up

What this points to is the need to understand your Linux config and what you need to have configured in the environment. Also, installing patches and updates are critically important across your hosts and your container images. Vulnerabilities can sneak in on the host or container image side. User namespaces may not be something that needs disabled everywhere. They are useful in certain use cases, but as with any service that isn’t needed, disabling it, reduces the attack surface.

Check out my recent post where we covered six recent Linux security vulnerabilities and what these involve here: https://www.virtualizationhowto.com/2026/10/these-new-linux-security-flaws-made-me-check-my-home-lab/

© 2026 Brandon Lee
548 Market Street PMB 72296, San Francisco, CA 94104