Image Builder security requirements

The Image Builder worker on Red Hat OpenShift Container Platform runs as a privileged workload with specific Linux capabilities. Review these requirements against cluster security policies before installation.

Image Builder deployment scope
Copy link

Image Builder is optional. You need it only when you build device operating system images from the Red Hat Edge Manager web console or API on the cluster.

If you build images outside Red Hat Edge Manager (for example with bootc-image-builder on a subscribed Red Hat Enterprise Linux host), set imageBuilderWorker.enabled to false in your Helm values. When Image Builder is disabled, the privileged workload is not deployed and you can omit it from your security review.

For image builds outside the control plane, see Operating system images for Red Hat Edge Manager in the Additional resources section.

Privileged workload requirements
Copy link

The flightctl-imagebuilder-worker deployment runs under a dedicated ServiceAccount also named flightctl-imagebuilder-worker. The worker pod securityContext requires the following settings:

  • privileged: true
  • Linux capabilities: SYS_ADMIN, MKNOD, SYS_CHROOT, and SETFCAP

These requirements come from the container-in-container operating system image build toolchain. During a build, the worker orchestrates nested containers that run podman build, bootc-image-builder, and osbuild.

Note

Elevated privileges apply only to the Image Builder worker ServiceAccount. Other Red Hat Edge Manager control plane components do not require privileged: true or these capabilities.

OpenShift Security Context Constraints
Copy link

When you install Red Hat Edge Manager with the Helm chart on Red Hat OpenShift Container Platform, the chart creates a cluster-scoped SecurityContextConstraints (SCC) resource named flightctl-imagebuilder-worker. This SCC grants the privileged container settings and capabilities listed above to the Image Builder worker ServiceAccount only.

The SCC is created when imageBuilderWorker.enabled is true (the default). If your cluster policy blocks custom SCC resources, coordinate with your cluster administrator before installing Red Hat Edge Manager with Image Builder enabled.

Security teams can verify the SCC after installation:

$ oc get scc flightctl-imagebuilder-worker
$ oc describe scc flightctl-imagebuilder-worker

For general information about SCCs on Red Hat OpenShift Container Platform, see Managing security context constraints in the Red Hat OpenShift Container Platform documentation.

Disabling Image Builder
Copy link

To install Red Hat Edge Manager without the Image Builder worker, set the following Helm value before or during installation:

imageBuilderWorker:
  enabled: false

When Image Builder is disabled, the worker deployment, ServiceAccount, and custom SCC are not created.