:_mod-docs-content-type: ASSEMBLY
[id="security-hosts-vms"]
= Understanding host and VM security
include::_attributes/common-attributes.adoc[]
:context: security-hosts-vms

toc::[]

[role="_abstract"]
Containers and virtual machines provide ways of separating applications running on a host from the operating system itself. You should understand {op-system}, which is the operating system used by {product-title}, to see how the host systems protect containers and hosts from each other.


// How containers are secured on {op-system}
include::modules/security-hosts-vms-rhcos.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* link:https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/building_running_and_managing_containers/index[Building, running, and managing containers]
* xref:../../nodes/nodes/nodes-nodes-resources-configuring.adoc#allocate-node-enforcement_nodes-nodes-resources-configuring[How nodes enforce resource constraints]
* xref:../../authentication/managing-security-context-constraints.adoc#managing-pod-security-policies[Managing security context constraints]
* xref:../../architecture/architecture-installation.adoc#supported-platforms-for-openshift-clusters_architecture-installation[Supported platforms for OpenShift clusters]
* xref:../../architecture/architecture-rhcos.adoc#rhcos-configured_architecture-rhcos[Choosing how to configure {op-system}]
* xref:../../architecture/architecture-rhcos.adoc#rhcos-about-ignition_architecture-rhcos[Ignition]
* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-kargs_installing-customizing[Kernel arguments]
* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-kmod_installing-customizing[Kernel modules]
* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-storage_installing-customizing[Disk encryption]
* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-chrony_installing-customizing[Chrony time service]
* xref:../../updating/understanding_updates/intro-to-updates.adoc#update-service-about_understanding-openshift-updates[About the OpenShift Update Service]
* link:https://www.redhat.com/en/resources/openshift-security-guide-ebook[Red Hat OpenShift security guide]
ifndef::openshift-origin[]
* xref:../../installing/overview/installing-fips.adoc#installing-fips[FIPS cryptography]
endif::[]

// Virtualization versus containers
include::modules/security-hosts-vms-vs-containers.adoc[leveloffset=+1]

// Securing OpenShift
include::modules/security-hosts-vms-openshift.adoc[leveloffset=+1]

ifndef::openshift-origin[]
[role="_additional-resources"]
.Additional resources
* xref:../../installing/overview/installing-fips.adoc#installing-fips[FIPS cryptography]
endif::[]
