How to Completely Disable ‘User Namespaces’ (userns) in Ubuntu Server

User Namespaces (userns) is a Linux kernel feature that allows unprivileged users to create isolated environments where they appear to have root privileges (UID 0) within that specific namespace, while remaining a standard user on the host system. This technology is the fundamental building block for rootless containers (like Podman or Docker in rootless mode). However, because userns exposes vast amounts of previously restricted kernel code to unprivileged users, it has historically been the source of numerous severe local privilege escalation (LPE) vulnerabilities. If your Ubuntu Server does not run containers or strictly relies on root-owned Docker daemons, leaving User Namespaces enabled is a massive, unnecessary security risk.

This guide explains how to completely disable User Namespaces in Ubuntu Server via a kernel parameter.

Disable User Namespaces via sysctl

Ubuntu utilizes the sysctl utility to modify kernel parameters at runtime. We will create a persistent configuration file to ensure the userns feature remains disabled across reboots.

1. Log into your Ubuntu Server via SSH or local console using an account with sudo privileges.
2. Create a new configuration file in the /etc/sysctl.d/ directory using a text editor (like nano):

   sudo nano /etc/sysctl.d/99-disable-userns.conf

3. Add the following single line to the empty file:

   kernel.unprivileged_userns_clone=0

4. Save the file (in nano, press Ctrl+O, Enter, then Ctrl+X).
5. Apply the new kernel parameter immediately without rebooting:

   sudo sysctl -p /etc/sysctl.d/99-disable-userns.conf

Note: On Ubuntu 24.04 and newer, Canonical introduced a more granular AppArmor-based restriction for userns. However, setting the unprivileged_userns_clone sysctl parameter remains the most absolute, sledgehammer approach to disabling the feature globally at the kernel level for unprivileged users.

Verify the Restriction

Once applied, standard users will be completely blocked from instantiating new namespaces.

To verify the lockdown is active, switch to a standard, non-root user account (or simply run the command as your normal user without sudo):

unshare -U echo "Namespaces are active"

Instead of echoing the text, the system will instantly reject the command and return a fatal error: “unshare: unshare failed: Operation not permitted.” This confirms that unprivileged users can no longer access the namespace API, drastically reducing your server’s attack surface.