OpenShift Containerfile Best Practices

Knowledge bundle covering best practices for authoring Containerfiles (Dockerfiles) that are compatible with Red Hat OpenShift Container Platform. Covers both the legacy restricted-v2 SCC model (OCP 4.11–4.19) and the restricted-v3 user namespace model (OCP 4.20+).

Concepts

UID Model — restricted-v2 (Legacy) — How OpenShift overrides the Containerfile USER directive with a random project-scoped UID under MustRunAsRange.
UID Model — User Namespaces (restricted-v3) — How Linux user namespaces with hostUsers: false change UID handling, and what restricted-v3 enforces.
SCC and SecurityContext Relationship — How Kubernetes SecurityContext fields interact with OpenShift’s SCC admission controller (validate + mutate).
File Permissions — GID 0 Pattern — The root group ownership pattern required under restricted-v2, and how idmap mounts change the picture under restricted-v3.
Base Images — UBI Selection — UBI variants (standard, minimal, micro, init), registries, and selection criteria.
Image Metadata and Labels — Required certification labels, OpenShift-specific labels, and OCI label conventions.
Layer Optimization — Multi-stage builds, cache ordering, dnf clean, layer count limits.
Runtime Constraints — Non-privileged ports, read-only root filesystem, entrypoint patterns, /etc/passwd injection.
Red Hat Certification Requirements — Certification test checklist: RunAsNonRoot, BasedOnUBI, HasLicense, HasRequiredLabel, LayerCountAcceptable, and more.
S2I Compatibility — Source-to-Image labels and scripts for building S2I builder images.

OpenShift Containerfile Best Practices

Shared agent scaffolding with skills, knowledge bundles, and cross-agent context

OpenShift Containerfile Best Practices

Concepts

Sources