Origin: Getting latest security updates in Docker and Kubernetes

[alikhajeh1]

This isn't a bug report, more of a question around best practices:

1. Installing Origin 1.3 via openshift-ansible installs docker 1.10.3, should we be updating to the latest docker version post-ansible to pickup the latest security fixes? and continually update docker when new security updates are released or are there restrictions on which docker versions Origin works with?
2. Are security updates in Kubernetes, such as https://access.redhat.com/security/cve/cve-2016-7075), applied to Origin in a timely manner? i.e. we should just update Origin and not try to patch Kubernetes ourself.

Version

oc v1.3.1
kubernetes v1.3.0+52492b4
features: Basic-Auth GSSAPI Kerberos SPNEGO

[mfojtik]

@alikhajeh1 afaik old versions of Origin have problems running with Docker 1.12, but the latest version should work with 1.12 (our CI use that version of Docker atm.). @smarterclayton do we have any release docs/readme that highlights what versions of Docker are compatible with given version of Origin?

All security issues are applied to Origin immediately after they are fixed in Kubernetes and become available in the next release (or in latest master).

[stevekuznetsov]

@mfojtik @alikhajeh1 the Docker version required for OpenShift is documented in pages like this one on our documentation website.

should we be updating to the latest docker version post-ansible to pickup the latest security fixes?

No, a given version of OpenShift will not always be compatible with newer versions of Docker. Furthermore, if you are installing Docker from yum or dnf on Fedora/CentOS/RHEL the distribution maintainers of the package will make sure security patches get back-ported from newer Docker releases.

Are security updates in Kubernetes, such as https://access.redhat.com/security/cve/cve-2016-7075), applied to Origin in a timely manner?

Yes. CVEs should hit both repositories at the same time, and non-critical fixes will get into Origin as soon as possible. For example, Origin v1.2.2 and v1.3.1 were recently released to apply security patches.

[rhatdan]

We also back port fixes to Red Hat based docker packages.