Differences betw RHEL 8 & 7  in terms of hardenings & impact to its container VMs

sunhux
sunhux used Ask the Experts™
on
Q1:
Is there any hardening guide for RHEL 8?
If there's none, can I assume it's very close to RHEL 7's hardenings?
Then I'll ask vendors to harden RHEL 8 as per CIS RHEL7's benchmark.

Q2:
We're hosting docker/microservices in an RHEL host: previously the
vendor tested using RHEL7: can I safely say it makes no difference/
impact to the services/app whether we use RHEL 7 or 8?

Q3:
at the VMs level is there any difference/impact?  The docker
instances is spinned from the various Ubuntu, Debian images,
so I'm guessing it doesn't matter which version of RHEL runs
on the VMs
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Fractional CTO
Distinguished Expert 2018
Commented:
Q1: Is there any hardening guide for RHEL 8?
If there's none, can I assume it's very close to RHEL 7's hardenings?
Then I'll ask vendors to harden RHEL 8 as per CIS RHEL7's benchmark.

Same hardening guides for any Distro will work for another... with possible minor changes, like config file locations.

Q1a: Then I'll ask vendors to harden RHEL 8 as per CIS RHEL7's benchmark.

This will relate to both the Linux Kernel + every piece of software (like Apache, PHP, MariaDB, etc) to be brought into compliance.

Expect to pay a fairly high price for CIS compliance hosting or to someone to bring all layers of your system into compliance.

Q2:
We're hosting docker/microservices in an RHEL host: previously the
vendor tested using RHEL7: can I safely say it makes no difference/
impact to the services/app whether we use RHEL 7 or 8?

Container systems like Docker + LXD should work the same across Distro major upgrades + be sure to test fully.

Q3:
at the VMs level is there any difference/impact?  The docker
instances is spinned from the various Ubuntu, Debian images,
so I'm guessing it doesn't matter which version of RHEL runs
on the VMs

Usually this will work.

Note: Something to keep in mind. RHEL 8 finally brings RedHat current, Kernel wise. So RHEL 7 ran an super old 3.10.x Kernel + RHEL 8 bumps to 4.18.x which means... RHEL 8 uses a Kernel with correct namespace implementation, which all container systems require.

If you were using any... oddball work arounds to fix any RHEL 7 namespace problems (there were quite a few), then be sure to remove all these work arounds, as they're no longer required.

Author

Commented:
Thanks very much.

>RHEL 8 uses a Kernel with correct namespace implementation, which all container systems require.
Can point me to a link/article which indicates container systems require this namespace implementation?
David FavorFractional CTO
Distinguished Expert 2018
Commented:
For a discussion about namespacing, you'll have to just dig into the docs for each container system, as this topic is covered normally in dev channels.

Not really an issue, so long as you use a 4.X Kernel.

You can type this command to see namespaces currently being used...

lsns

Open in new window


https://help.ubuntu.com/lts/serverguide/lxd.html makes some slight mention of namespacing.

Tip: Ubuntu is used as the native dev Distro for LXD + Docker.

If you're after best tested machine level OS for running containers, run latest Ubuntu LTS (Bionic right now), then if you really must run RHEL for some reason, run RHEL in an LXD container.

Also be sure to...

# Destroy all APT LXD packages...
apt-get -y purge liblxc-common liblxc1 lxcfs lxd lxd-client

# Install snap LXD
apt-get -y install snapd
snap install lxd

Open in new window


Note: If you use LXD, all updates come from SNAP now.

I only use LXD + scanning recent release notes for Docker, it appears Docker updates (real + latest + stable code) comes from SNAP now too.

My guess is RHEL probably implements SNAP well also.

If you have problems running different container systems native to RHEL 8, switch over to Ubuntu Bionic + see if problems magically clear up.
David FavorFractional CTO
Distinguished Expert 2018
Commented:
https://lxd.readthedocs.io/en/latest/requirements/#kernel-requirements provides namespace list of requirements for LXD.

https://medium.com/@nagarwal/understanding-the-docker-internals-7ccb052ce9fe provides a similar discussion for Docker.

Basically any container system will require the same Kernel namespace support. Full namespace Kernel support began appearing around the 3.13 version + really only became complete in the 4.X Kernel.

Kernel 5.2 currently has some minor namespace glitches, which will be fixed very quickly, as current glitch effects mount points under some circumstances.

Author

Commented:
Excellent, David, the information are very enlightening.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial