title: Does OpenShift support true multi-tenancy by segregating containers on host-level?
body: <p>It took me a while to kinda understand what <a href="https://www.openshift.org/" rel="nofollow">OpenShift</a> is and what it does (additionally to Kubernetes itself).</p>
  
  <p>My question refers to the current release of OpenShift Origin 1.1 (OpenShift 3.1).</p>
  
  <ul>
  <li>Does OpenShift support true multi-tenancy by running containers from separate tenants on dedicated hosts?</li>
  </ul>
  
  <p>Without going too much into detail, it should be common knowledge (if you're familiarized with Docker/Container security issues), that you can <strong>protect tenants from each other against container breakouts</strong> or other exploits only by doing <strong>container segregation on a host level</strong>.</p>
  
  <p>(I strongly recommend this ebook on <a href="https://gallery.mailchimp.com/979c70339150d05eec1531104/files/Docker_Security_Red_Hat.pdf" rel="nofollow">Docker Security</a>).</p>
  
  <p>The documentation of OpenShift only describes the concept of projects and users and the Kubernetes docs only state the concept of namespaces for scoping certain ressources.</p>
  
  <p>Thanks for any insights on this or your thoughts on this, if you have experience with running OpenShift as a multi-tenant Container/PaaS platform for developers or customers.</p>