Re: Beginner Question


James Bayer
 

konstantin,

only red hat can distribute RHEL. CF is OSS, therefore centos is what we
build and distribute as part of the cloud foundry foundation projects as a
bosh stemcell.

i'm not sure what source you got this comment from:
*This is due to an inherent security issue with the way RedHat handles user
namespacing and container isolation.*

BOSH does not use cgroups and namespaces itself. the cloud foundry runtime
that is optionally installed on top of BOSH uses cgroups and namespaces as
part of either warden (for DEAs) or garden (for diego with garden-linux).
when using garden-linux, cloud foundry relies on user namespaces for
enhanced isolation, which are not yet in the kernel for centos7.1 or
rhel7.1 and lower, which i believe is still at kernel version 3.10 [1].

in addition to the kernel features for cgroups and namespaces, cloud
foundry does a lot of testing for container file systems, and is currently
using AUFS and ubuntu 14.04LTS with a 3.19 kernel. we have found that AUFS
has the best stability and features set that we need compared to btrfs and
overlay (aka overlayfs).

also, soon the cloud foundry stemcells using ubuntu will support kernel 4.2
because of ubuntu support timelines.

the nuances of the kernel and os distribution really do matter quite a bit.
the cf engineering team strives to make the linux experience as much like a
linux appliance as possible. i hope that helps.

[1]
http://unix.stackexchange.com/questions/200574/centos-7-1-still-using-outdate-kernel-3-10-how-to-upgrade-to-kernel-4-0


On Thu, Feb 4, 2016 at 2:49 AM, Konstantin Kiess <konstantin.kiess(a)gmx.de>
wrote:

Is there any reason that bosh runs on a centos basis but not on rhel?

Im quite confused about this. pivotal states that: „BOSH does not support
a RedHat Enterprise Linux OS stemcell. This is due to an inherent security
issue with the way RedHat handles user namespacing and container
isolation.” but since RHEL and CentOS are binary compatible, i cant figure
out the reason...

thx in advance
konstantin


--
Thank you,

James Bayer

Join {cf-bosh@lists.cloudfoundry.org to automatically receive all group messages.