$ show rootless-containers/usernetes
Usernetes is a tool for deploying Kubernetes clusters without requiring root privileges on the host, mitigating potential container-breakout vulnerabilities. It supports two deployment modes: Kubernetes-in-Docker (using rootless container engines like Docker, Podman, or nerdctl) and Kubernetes-in-Kubernetes (running as UserNS-enabled pods in an existing Kubernetes cluster). The architecture is modular, consisting of a container image packaging Kubernetes components, Docker Compose/Kubernetes manifests for orchestration, a Makefile for management tasks, and helper scripts for initialization and networking. Key features include automatic subnet assignment based on hostname hashes, container engine detection, and seamless integration with kubeadm for cluster bootstrap.
The LLM identified 4 files worth highlighting for reuse:
Detects available container engines (docker, nerdctl, podman) and determines their type and appropriate compose command. This self-contained script demonstrates good practice in handling multiple container runtimes with minimal dependencies, making it easily reusable in other projects needing container engine agnosticism.
Calculates a unique subnet for each node based on a hash of the hostname, ensuring no IP conflicts in multi-host deployments. This clever networking solution uses only standard shell utilities and could be extracted for use in any project requiring deterministic subnet assignment.
Updates Kubernetes node status with ExternalIP addresses, propagates the IP to flannel annotations, and removes specific taints. This kubectl-based script demonstrates good patterns for Kubernetes node management and could be reused in any Kubernetes setup requiring custom IP configuration with minimal modification.
Configures sysctls (ip_forward, rp_filter) and customizes kubelet arguments when the container starts. It also handles importing control plane hosts from a hosts.u7s file. This container entrypoint demonstrates solid practices for sysctl management in containerized Kubernetes environments and depends only on common utilities like sponge.