Hardening CI Workloads with Kubernetes User Namespaces in the GitLab Runner Helm Chart

Container isolation is a fundamental part of running CI workloads securely. But running a container as root inside a Kubernetes pod does not necessarily mean that its root identity is isolated from the host in the way operators expect.

Kubernetes User Namespaces help address this by mapping user IDs inside a pod to different user IDs on the host. With hostUsers: false , containers can run as root inside their user namespace while that identity maps to an unprivileged identity on the host node.

The GitLab Runner binary already supported the Kubernetes executor settings host_users and host_users_overwrite_allowed .…