<p>It took me a while to kinda understand what <a href="https://www.openshift.org/" rel="nofollow">OpenShift</a> is and what it does (additionally to Kubernetes itself).</p>

<p>My question refers to the current release of OpenShift Origin 1.1 (OpenShift 3.1).</p>

<ul>
<li>Does OpenShift support true multi-tenancy by running containers from separate tenants on dedicated hosts?</li>
</ul>

<p>Without going too much into detail, it should be common knowledge (if you're familiarized with Docker/Container security issues), that you can <strong>protect tenants from each other against container breakouts</strong> or other exploits only by doing <strong>container segregation on a host level</strong>.</p>

<p>(I strongly recommend this ebook on <a href="https://gallery.mailchimp.com/979c70339150d05eec1531104/files/Docker_Security_Red_Hat.pdf" rel="nofollow">Docker Security</a>).</p>

<p>The documentation of OpenShift only describes the concept of projects and users and the Kubernetes docs only state the concept of namespaces for scoping certain ressources.</p>

<p>Thanks for any insights on this or your thoughts on this, if you have experience with running OpenShift as a multi-tenant Container/PaaS platform for developers or customers.</p>

<p>The host level multi-tenancy is not the same as true multi-tenancy.  Kubernetes and docker protect the host.  This isn’t an OpenShift thing.  For example <a href="https://access.redhat.com/documentation/en-us/openshift_container_platform/3.10/html/container_security_guide/security-hosts" rel="nofollow noreferrer">https://access.redhat.com/documentation/en-us/openshift_container_platform/3.10/html/container_security_guide/security-hosts</a> talks about cgroups and namespaces as providing protection.  cgroups and namespaces is how docker works in Linux.</p>
<p>OpenShift does provide RBAC for developers.  If you use the OpenShift “Source to Image” features they provide additional protections of the cluster as a whole.  But nothing OpenShift provides protection at the pod or service level.  You need custom SDNs like Calico (<a href="https://docs.projectcalico.org/about/about-calico" rel="nofollow noreferrer">https://docs.projectcalico.org/about/about-calico</a>) and Flannel (<a href="https://github.com/coreos/flannel" rel="nofollow noreferrer">https://github.com/coreos/flannel</a>) if you want your pods to be secure.</p>
<p>Why does this matter?
Having host level security is equivalent to focusing on locks on your doors when your having a party at your house.  You wouldn’t leave your wallet or social security card out on the kitchen table when you have a party because they are a bunch of people running around.  If you run multi tenants in the same cluster — your having a party.  A bunch of tenants a running compute on the same cluster.</p>
<p>But what about tags and taints?
Tags and taint is like saying we’re going to have a party, but everyone agrees to stay at their own house.  Every tenant gets their own hosts.  From a security perspective, at that point what are you gaining?  You could just as easily run on straight IaaS (for example AWS) and have the same posture.  Only difference is you haven’t paid RedHat a boat load of money.  Also OpenShift doesn’t ensure tenants use specific tags or taints...</p>
