Chapter 29. Red Hat Enterprise Linux Atomic Host 7.4.0

Limited support for containers on little-endian IBM power systems

Now containers have limited support on the little-endian variant of IBM power Systems (PPCle). See the Supported Architectures for Containers on RHEL for details.

Notably, packages from the Extras channel are now provided for the little-endian variant of IBM power Systems, along with the rhel7-ppc64le base container. This enables using containers on these systems with Red Hat Enterprise Linux 7.4.

overlay2 storage driver now available

The overlay2 graph driver has been upgraded from a Technology Preview to a fully supported feature.

The overlay2 graph driver, along with overlay, uses OverlayFS, a copy-on-write union file system that features page-cache sharing between containers. However, overlay2 is the more performant option.

To enable the driver, specify overlay2 in the /etc/sysconfig/docker-storage-setup file:

STORAGE_DRIVER=overlay2

OverlayFS now can be run with SELinux enforced

Previously, SELinux had to be in permissive or disabled mode for OverlayFS to work. Now you can run the OverlayFS file system with SELinux in enforcing mode.

For more information on OverlayFS, see Overlay Graph Driver.

SSSD in a container is now fully supported

The System Security Services Daemon (SSSD) in a container has been upgraded from a Technology Preview to a fully supported feature.

SSSD allows Red Hat Enterprise Linux Atomic Host authentication subsystem to be connected to central identity providers such as Red Hat Identity Management and Microsoft Active Directory.

To install this new image, use the atomic install rhel7/sssd command.

For full documentation on SSSD, see Configuring SSSD.

Package layering is now fully supported

The pkg-add subcommand of the rpm-ostree tool has been upgraded from a Technology Preview to a fully supported feature.

The rpm-ostree install commands installs layered packages that are persistent across reboots. This command can be used to install individual packages that are not part of the original OSTree, such as diagnostics tools. For detailed information about package layering, see Package Layering.

Image signing is now fully supported

The image signing and validation functionality has been upgraded from a Technology Preview to a fully supported feature.

Signing container images on RHEL and RHEL Atomic Host systems provides a means of validating where a container image came from, checking that the image has not been tampered with, and setting policies to determine which validated images you will allow to use on your systems.

The main image signing tasks can be done as follows:

For the current release, image signing is only supported when pushing and pulling between Docker v2 registries (such as the registry software included in the docker-distribution package) and the Docker Hub (docker.io).

To learn more about image signing, see Image Signing.

GPG verification changes for OSTree commits

For new installations of RHEL Atomic Host 7.4.0 and later, the GPG verification of OSTree commits is enabled by default. If you upgrade from RHEL Atomic Host 7.3, you can enable GPG verification manually.

To enable GPG verification, set the gpg-verify directive in the /etc/ostree/remotes.d/redhat.conf file to true.

If GPG verification is enabled, the output of the atomic host status command shows information about the GPG signature of the commit.

docker-storage-setup renamed to container-storage-setup

The docker-storage-setup utility has been renamed to container-storage-setup for RHEL7.4 and RHEL Atomic Host 7.4. Note that: