3 ms·
I haven't administered an OpenShift cluster but I've used one and you notice the difference in policy approach. OpenShift seems to have a lot of default policie
by chrisfosterelli 7y ago
I haven't administered an OpenShift cluster but I've used one and you notice the difference in policy approach. OpenShift seems to have a lot of default policies that are more aggressive than Kubernetes. A lot of container images from Docker Hub just don't run at all on OpenShift without modification due to this.
The biggest thing is that they don't allow containers to run as root, but they also have other features like blocking hostPath mounts and offering SELinux integration. Nearly all of this can be turned off (if you have permissions to do that in the RBAC) but they generally take the "secure by default" approach.
- pat2man 7y agoOpenShift also has some features that help with known attacks (easy cluster upgrades, image vulnerability scanning, etc).
- freedomben 7y agoCorrect. OpenShift by default will start your container with a "random" UID (it's not technically random but to a user it will feel that way), so not only is root disallowed but you also can't anticipate being any specific user. This can feel annoying at times but has important implications for running on the host. you can read more here if interested: https://cookbook.openshift.org/users-and-role-based-access-control/why-do-my-applications-run-as-a-random-user-id.html https://cookbook.openshift.org/users-and-role-based-access-c... OpenShift also moves to CRI-O and rootless containers in later version, which further protects hosts.