OpenShift sandboxed containers 1.0 release notes

If you are using OpenShift sandboxed containers, you cannot use the hostPath volume in a OpenShift Container Platform cluster to mount a file or directory from the host node’s file system into your pod. As an alternative, you can use local persistent volumes. See Persistent storage using local volumes for more information. (BZ#1904609)

If you are running Fedora on OpenShift sandboxed containers, you need a workaround to install some packages. Some packages, like iputils, require file access permission changes that OpenShift Container Platform does not grant to containers by default. To run containers that require such special permissions, it is necessary to add an annotation to the YAML file describing the workload, which tells virtiofsd to accept such file permissions for that workload. The required annotations are:

io.katacontainers.config.hypervisor.virtio_fs_extra_args: |
  [ "-o", "modcaps=+sys_admin", "-o", "xattr" ]

In the 4.8 release, adding a value to kataConfgPoolSelector by using the OpenShift Container Platform web console causes scheduling.nodeSelector to be populated with an empty value. Pods that use RuntimeClass with the value of kata might be scheduled to nodes that do not have the Kata Containers runtime installed.

$ oc edit runtimeclass kata

apiVersion: node.k8s.io/v1
handler: kata
kind: RuntimeClass
metadata:
  creationTimestamp: "2021-06-14T12:54:19Z"
  name: kata
overhead:
  podFixed:
    cpu: 250m
    memory: 350Mi
scheduling:
  nodeSelector:
    custom-kata-pool: "true"

The OpenShift sandboxed containers Operator details page on Operator Hub contains a few missing fields. The missing fields do not prevent you from installing the OpenShift sandboxed containers Operator in 4.8. (BZ#2019383)

Creating multiple KataConfig custom resources results in a silent failure. The OpenShift Container Platform web console does not provide a prompt to notify the user that creating more than one custom resource has failed. (BZ#2019381)

Sometimes the Operator Hub in the OpenShift Container Platform web console does not display icons for an Operator. (BZ#2019380)