A hands-on guide to enabling user namespaces in Kubernetes 1.36, the kernel 6.3 and containerd 2.0 prerequisites, the /etc/subuid math, and the silent failures.