You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: README.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -50,7 +50,7 @@ The latest OKD Origin images are published to the Docker Hub under the `openshif
50
50
51
51
### Concepts
52
52
53
-
OKD builds a developer-centric workflow around Docker containers and Kubernetes runtime concepts. An **Image Stream** lets you easily tag, import, and publish Docker images from the integrated registry. A **Build Config** allows you to launch Docker builds, build directly from source code, or trigger Jenkins Pipeline jobs whenever an image stream tag is updated. A **Deployment Config** allows you to use custom deployment logic to rollout your application, and Kubernetes workflow objects like **DaemonSets**, **Deployments**, or **StatefulSets** are upgraded to automatically trigger when new images are available. **Routes** make it trivial to expose your Kubernetes services via a public DNS name. As an administrator, you can enable your developers to request new **Projects** which come with predefined roles, quotas, and security controls to fairly divide access.
53
+
OKD builds a developer-centric workflow around containers and Kubernetes runtime concepts. An **Image Stream** lets you easily tag, import, and publish Docker images from the integrated registry. A **Build Config** allows you to launch Docker builds, build directly from source code, or trigger Jenkins Pipeline jobs whenever an image stream tag is updated. A **Deployment Config** allows you to use custom deployment logic to rollout your application, and Kubernetes workflow objects like **DaemonSets**, **Deployments**, or **StatefulSets** are upgraded to automatically trigger when new images are available. **Routes** make it trivial to expose your Kubernetes services via a public DNS name. As an administrator, you can enable your developers to request new **Projects** which come with predefined roles, quotas, and security controls to fairly divide access.
54
54
55
55
For more on the underlying concepts of OKD, please see the [documentation site](https://docs.okd.io/latest/welcome/index.html).
56
56
@@ -103,7 +103,7 @@ OKD runs with the following security policy by default:
103
103
* By default, Docker builds can (and often do) run as root. You can control who can create Docker builds through the `builds/docker` and `builds/custom` policy resource.
104
104
* Regular users and project admins cannot change their security quotas.
105
105
106
-
Many Docker containers expect to run as root (and therefore edit all the contents of the filesystem). The [Image Author's guide](https://docs.okd.io/latest/creating_images/guidelines.html#openshift-specific-guidelines) gives recommendations on making your image more secure by default:
106
+
Many containers expect to run as root (and therefore edit all the contents of the filesystem). The [Image Author's guide](https://docs.okd.io/latest/creating_images/guidelines.html#openshift-specific-guidelines) gives recommendations on making your image more secure by default:
107
107
108
108
* Don't run as root
109
109
* Make directories you want to write to group-writable and owned by group id 0
Copy file name to clipboardexpand all lines: docs/builds.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
## Problem/Rationale
4
4
5
-
Kubernetes creates Docker containers from images that were built elsewhere and pushed to a Docker registry. Building Docker images is a foundational use-case in Docker-based workflows for application development and deployment. Without support for builds in Kubernetes, if a system administrator wanted a system that could build images, he or she would have to select a pre-existing build system or write a new one, and then figure out how to deploy and maintain it on or off Kubernetes. However, in most cases operators would wish to leverage the ability of Kubernetes to schedule task execution into a pool of available resources, and most build systems would want to take advantage of that mechanism.
5
+
Kubernetes creates containers from images that were built elsewhere and pushed to a Docker registry. Building Docker images is a foundational use-case in Docker-based workflows for application development and deployment. Without support for builds in Kubernetes, if a system administrator wanted a system that could build images, he or she would have to select a pre-existing build system or write a new one, and then figure out how to deploy and maintain it on or off Kubernetes. However, in most cases operators would wish to leverage the ability of Kubernetes to schedule task execution into a pool of available resources, and most build systems would want to take advantage of that mechanism.
6
6
7
7
Offering an API for builds makes OpenShift a viable back-end for arbitrary third-party Docker image build systems which require resource constraints and scheduling capabilities, and allows organizations to orchestrate Docker builds from their existing continuous integration processes. OpenShift enables CI/CD flows around Docker images.
8
8
@@ -57,7 +57,7 @@ There are viable paths to alleviate or resolve each of these disadvantages, and
57
57
58
58
##### Why not Docker-in-Docker?
59
59
60
-
It's theoretically possible to implement builds using a nested Docker daemon within a Docker container (Docker-in-Docker). On the surface, this approach offers some compelling advantages:
60
+
It's theoretically possible to implement builds using a nested Docker daemon within a container (Docker-in-Docker). On the surface, this approach offers some compelling advantages:
61
61
62
62
1. Build process resources can be naturally constrained to the user’s acceptable limits (cgroups)
63
63
2. Containers created during the build have the build container as their parent process, making container cleanup simple
Copy file name to clipboardexpand all lines: docs/debugging-openshift.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -47,7 +47,7 @@ and you can get the build id via:
47
47
48
48
the build id is in the first column.
49
49
50
-
If you're unable to retrieve the logs in this way, you can also get them directly from docker. First you need to find the docker container that ran your build:
50
+
If you're unable to retrieve the logs in this way, you can also get them directly from docker. First you need to find the container that ran your build:
51
51
52
52
$ docker ps -a | grep builder
53
53
@@ -119,7 +119,7 @@ Obviously this won't work if you don't have bash installed but you could always
119
119
Name Resolution Within Containers
120
120
-------------------
121
121
122
-
DNS related services like `dnsmasq` can interfere with naming resolution in the Docker containers launched by OpenShift, including binding on the same port (53) that OpenShift will attempt to use. To circumvent this conflict, disable
122
+
DNS related services like `dnsmasq` can interfere with naming resolution in the containers launched by OpenShift, including binding on the same port (53) that OpenShift will attempt to use. To circumvent this conflict, disable
123
123
these services. Using the `dnsmasq` example on Fedora, run all three of the following before starting OpenShift to ensure `dnsmasq` is not running, does not launch later on, and hence does not interfere with OpenShift:
Copy file name to clipboardexpand all lines: docs/images.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
# OpenShift Images
2
2
## Problem/Rationale
3
-
Kubernetes creates Docker containers from images stored in Docker registries. It does not currently track and store any information about images; it merely pulls and stores them locally on a minion as part of the pod creation process.
3
+
Kubernetes creates containers from images stored in Docker registries. It does not currently track and store any information about images; it merely pulls and stores them locally on a minion as part of the pod creation process.
4
4
5
5
Adding information related to images - image repositories, the images themselves, tags, and metadata - as resources in an image component will provide foundational support for several use cases, listed below.
OpenShift no longer requires SElinux to be disabled, however OpenShift is a system which runs Docker containers on your system. In some cases (build operations and the registry service) it does so using privileged containers. Furthermore those containers access your host's Docker daemon and perform `docker build` and `docker push` operations. As such, you should be aware of the inherent security risks associated with performing `docker run` operations on arbitrary images as they effectively have root access. This is particularly relevant when running the OpenShift nodes directly on your host system.
18
+
OpenShift no longer requires SElinux to be disabled, however OpenShift is a system which runs containers on your system. In some cases (build operations and the registry service) it does so using privileged containers. Furthermore those containers access your host's Docker daemon and perform `docker build` and `docker push` operations. As such, you should be aware of the inherent security risks associated with performing `docker run` operations on arbitrary images as they effectively have root access. This is particularly relevant when running the OpenShift nodes directly on your host system.
19
19
20
20
For more information, see these articles:
21
21
@@ -415,7 +415,7 @@ Another interesting example is deleting a pod.
415
415
416
416
$ oc delete pod frontend-1-votq4
417
417
418
-
- Verify that the pod has been removed by listing the available pods. This also stopped the associated Docker container, you can check using the command:
418
+
- Verify that the pod has been removed by listing the available pods. This also stopped the associated container, you can check using the command:
419
419
420
420
$ docker ps -a
421
421
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
@@ -430,6 +430,6 @@ To clean up all of your environment, you can run the script:
430
430
431
431
$ sudo ./cleanup.sh
432
432
433
-
This will stop the `openshift` process, remove files created by OpenShift and kill all Docker containers created by Kubernetes in your host system. The cleanup script needs root privileges to be able to remove all the directories OpenShift created.
433
+
This will stop the `openshift` process, remove files created by OpenShift and kill all containers created by Kubernetes in your host system. The cleanup script needs root privileges to be able to remove all the directories OpenShift created.
434
434
435
-
**Use with caution!** Any Docker container prefixed with "k8s_" will be killed by this script.
435
+
**Use with caution!** Any container prefixed with "k8s_" will be killed by this script.
0 commit comments