Defense in Depth in OpenShift

The blog post below does a good job describing some of the security layers in OpenShift/Kubernetes. Here are some highlights:

"There are multiple levels of security and a lot of history involved in securing containers on Linux. Linux namespaces, SELinux, and CGroups are three of the of the main players."

"By default, since OpenShift maintains a secure by default posture, you can’t run containers as root."

"SELinux is the brick wall that’s going to stop you if you manage to break out of (accidentally or on purpose) from the namespace abstraction."

But that blog post doesn't mention a recent achievement: Common Criteria Security Certification for Red Hat Enterprise Linux 7.

"...this achievement also marks our flagship operating system as the first to bring a framework for Linux container technology into the world of more secure, certified computing."