User namespaces graduated stable in Kubernetes 1.36: pod-level isolation without gVisor | Jorijn Schrijvershof

Kubernetes 1.36 makes user namespaces GA. How UID remapping isolates pods, what breaks, runtime requirements, and how it compares to gVisor and Kata Containers.