Kubernetes v1.37 promotes KubeletInUserNamespace to beta, allowing node components like kubelet and runtimes to run as non-root users. This rootless mode, an evolution from a 2018 experiment, enhances security by confining potential container breakout vulnerabilities. Unlike pod user namespaces, this focuses on the host's node components. The feature mitigates risks from vulnerabilities such as CVE-2022-0811 and CVE-2023-27561, which historically could grant attackers root privileges. By running in a user namespace, an attacker's impact is limited to the non-root user's account, preventing kernel or firmware modification. User namespaces do not protect against kernel vulnerabilities themselves and should be combined with other hardening measures like seccomp. This feature has various use cases, including production clusters, shared machines, laptops, and AI sandboxes. It works by mapping a host non-root user to a fake root inside the namespace, which suffices for most node component tasks. The user namespace must be created externally, for example, using Rootless Docker. The KubeletInUserNamespace feature gate, now enabled by default, allows kubelet to ignore specific permission errors. Recent improvements include better support for idmapped tmpfs, user-namespaced pods, and writable cgroups, enabling nested Kubernetes deployments. Tools like kind, minikube, Usernetes, and k3s offer easy ways to create rootless Kubernetes clusters. The project plans to graduate this feature to General Availability in the future and welcomes community involvement.