trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-21 06:11:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: move user namespace support into table

Browse Source 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
This commit is contained in:
Drew Newberry
2026-07-06 12:38:09 -07:00
parent 87b4d69ae2
commit 85dd7a5277
1 changed files with 1 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/support-matrix.mdx
+1 -6
View File
@@ -75,17 +75,12 @@ OpenShell runs on Kubernetes as a distributed, multi-tenant application.
| Kubernetes | 1.29 or later | Required for Helm deployments and sandbox scheduling. |
| Helm | 3.x | Required to install and upgrade the OpenShell chart. |
| Agent Sandbox controller and CRDs | Compatible release; version TBD | Required before installing the OpenShell chart. |
| User namespaces | 1.33 or later | Optional. Policy enforcement remains available without support, but Kubernetes cannot set `hostUsers: false` for UID remapping. See [User Namespace Isolation guidance](/security/best-practices#user-namespace-isolation). |
Kubernetes deployments require the Agent Sandbox controller and its `Sandbox`
CRDs before the OpenShell Helm chart is installed. The
[Kubernetes setup guide](/kubernetes/setup) provides installation instructions.
User namespaces are optional. Without user namespace support, OpenShell policy
enforcement remains available, but Kubernetes cannot set `hostUsers: false` to
map container UID 0 to an unprivileged host UID. The
[User Namespace Isolation guidance](/security/best-practices#user-namespace-isolation)
describes prerequisites and security effects.
### Distributions
- GKE Standard and Autopilot clusters are supported.