<p>My situation: I have a microservice running Ubuntu 18.04 on GKE for evaluating the user's code. Every time, a user logs into her project, the service receives the user ID and project ID and it mounts a correct GCS bucket through a <a href="https://github.com/GoogleCloudPlatform/gcsfuse" rel="nofollow noreferrer">user-space file system</a> based on these IDs. This service can be accessed by multiple users at the same time.</p>

<p>My goal: How can I achieve user isolation in a way that each user "lives" in their own filesystem and can't "see" other mounted file systems?</p>

<p>Ideas:</p>

<ul>
<li>Run a docker container inside a docker container</li>
<li>Start pods on demand every time a new user logs in</li>
<li>Isolate users on the OS level</li>
</ul>

<p>What about to let your application to spawn a Pod for each user using <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">SecurityContext</a>?</p>

<p>You could specify <code>fsGroup</code> (from the doc: <em>volumes that support ownership management are modified to be owned and writable by the GID specified in fsGroup</em>) in order to enhance the segregation you want.</p>

<p>The challenging part is the clean-up of old Pods no more used, so it must be supervised by your application or, in case of <em>logout</em> (I guess since I don't have so many details about your architecture) performs a clean-up taking advantages of the label system provided by Kubernetes.</p>
