Security Context Constraints (SCC)<\/strong> are OpenShift\u2019s mechanism for controlling security-sensitive aspects<\/strong> of how containers run in the cluster. SCCs define a set of rules that govern what actions a pod<\/strong> or container<\/strong> can perform and what privileges it can have.<\/p>\n\n\n\n They are a powerful RBAC + security enforcement layer<\/strong>, unique to OpenShift, built to enforce strong multi-tenancy and non-root container execution<\/strong> \u2014 making it more secure than vanilla Kubernetes by default.<\/p>\n\n\n\n By default, OpenShift enforces non-root, least privilege<\/strong> principles through SCCs. This prevents containers from:<\/p>\n\n\n\n This protects the cluster from poorly configured or potentially malicious workloads.<\/p>\n\n\n\n You can view all SCCs in your cluster with:<\/p>\n\n\n And inspect details with:<\/p>\n\n\n OpenShift assigns SCCs using RBAC bindings<\/strong> to users, groups, or service accounts. Example:<\/p>\n\n\n This allows your pod to run under the <\/p>\n","protected":false},"excerpt":{"rendered":" \ud83d\udd10 What are Security Context Constraints (SCC) in OpenShift? Security Context Constraints (SCC) are OpenShift\u2019s mechanism for controlling security-sensitive aspects of how containers run in the cluster. SCCs define a… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[5153],"tags":[],"class_list":["post-49282","post","type-post","status-publish","format-standard","hentry","category-openshift"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49282"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49282\/revisions"}],"predecessor-version":[{"id":49283,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49282\/revisions\/49283"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\n\n\n\ud83d\udea7 Why SCCs Matter<\/h3>\n\n\n\n
\n
\n\n\n\n\ud83e\uddf1 Key Features of SCC<\/h3>\n\n\n\n
SCC Attribute<\/strong><\/th> What It Does<\/strong><\/th><\/tr><\/thead> runAsUser<\/code><\/td>Controls if the pod can run as root or must use a specific UID<\/td><\/tr> seLinuxContext<\/code><\/td>Defines SELinux labels that must be applied to containers<\/td><\/tr> allowPrivilegedContainer<\/code><\/td>Determines whether a pod can request privileged mode<\/td><\/tr> volumes<\/code><\/td>Limits which volume types (e.g., hostPath, PVC) a pod can mount<\/td><\/tr> allowHostNetwork<\/code><\/td>Determines if a pod can use the host\u2019s network namespace<\/td><\/tr> allowHostPID\/IPC<\/code><\/td>Controls access to the host\u2019s PID or IPC namespaces<\/td><\/tr> readOnlyRootFilesystem<\/code><\/td>Forces the container to use a read-only root filesystem<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n\ud83e\udde9 Default SCCs in OpenShift<\/h3>\n\n\n\n
SCC Name<\/strong><\/th> Use Case<\/strong><\/th> Allows Running as Root?<\/strong><\/th> Privileged?<\/strong><\/th><\/tr><\/thead> restricted<\/code><\/td>Default for most users<\/td> \u274c No<\/td> \u274c No<\/td><\/tr> anyuid<\/code><\/td>For workloads that require root<\/strong><\/td> \u2705 Yes<\/td> \u274c No<\/td><\/tr> privileged<\/code><\/td>For system-level workloads<\/td> \u2705 Yes<\/td> \u2705 Yes<\/td><\/tr> hostaccess<\/code><\/td>Allows host network and volumes<\/td> \u2705 Yes<\/td> \u274c No<\/td><\/tr> nonroot<\/code><\/td>Must run as non-root explicitly<\/td> \u274c No<\/td> \u274c No<\/td><\/tr> baseline<\/code> (v4.x+)<\/td>Common for unprivileged workloads<\/td> \u274c No<\/td> \u274c No<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n oc get<\/span> scc\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\noc describe scc restricted\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n\ud83d\udd11 Binding SCCs to Users\/Service Accounts<\/h3>\n\n\n\n
oc adm policy add-scc-to-user anyuid -z myserviceaccount -n mynamespace\n<\/code><\/span><\/pre>\n\n\nanyuid<\/code> SCC \u2014 enabling it to run as root, if required.<\/p>\n\n\n\n
\n\n\n\n\u26a0\ufe0f Common SCC-Related Errors<\/h3>\n\n\n\n
\n
restricted<\/code> SCC not allowing root.<\/li>\n\n\n\n
\n\n\n\n\u2705 Best Practices<\/h3>\n\n\n\n
\n
restricted<\/code><\/strong> SCC whenever possible.<\/li>\n\n\n\nanyuid<\/code> or privileged<\/code> unless absolutely necessary.<\/li>\n\n\n\nhostPath<\/code> volumes or specific capabilities).<\/li>\n\n\n\n
\n\n\n\n