Container isolation

We already discussed aspects such as user authentication and permissions, as well as certificates, but how do you make sure your containers can only do what they are supposed to do and nothing more, and as such, cannot escalate privileges on the host?

We are going to discuss in this section some of the concepts implemented as part of the operating system (OS) to securely run containers and also some aspects implemented on OpenShift related to this.

In the following table, you see some concepts related to containers:

In the following diagram, you can see a graphical representation of these concepts:

Figure 8.2 – Container isolation

While it is important to understand these concepts, you don’t really need to work directly with any of them, as OpenShift abstracts those configurations for you. Instead, you need to understand what security context constraints (SCCs) are—these are the...