Cloud Parts

Red Hat OpenShift

Red Hat’s Kubernetes platform: Kubernetes plus its own OS, operators that install and upgrade everything, and stricter security defaults, sold by subscription.

What it is
Container orchestration
Used for
Platform as a service (PaaS)
Part of
Kubernetes distribution
Type
Commercial product
Made by
Red Hat
License
Proprietary subscription (built from open source; the OKD community distribution is Apache 2.0)
Facts checked
6 October 2026
Website Source code

What it is

OpenShift Container Platform is a Kubernetes distribution that also owns the layers around it. Every node runs Red Hat Enterprise Linux CoreOS (RHCOS), an image-based, mostly read-only RHEL with the CRI-O runtime, which the cluster updates as one atomic unit through its Machine Config Operator. The platform itself (Kubernetes core services, networking, monitoring, the console, the image registry) is installed and upgraded by operators, which also update Kubernetes and the RHCOS hosts during an over-the-air upgrade. Operator Lifecycle Manager and the OperatorHub catalog install and update further operators, such as databases or a service mesh.

On top of Kubernetes it adds its own APIs and tools: Projects, Routes that publish a Service at a hostname through an HAProxy-based ingress router, a built-in image registry with ImageStreams, Source-to-Image builds, a web console and the oc CLI. It is also stricter by default: the restricted-v2 security context constraint (SCC) drops all Linux capabilities, blocks privilege escalation and runs each container as an arbitrary non-root UID from its project’s range, so images that assume root often need changes.

You can run it yourself, or as a managed service: Red Hat OpenShift Service on AWS (ROSA), operated jointly by AWS and Red Hat and billed through AWS, or Azure Red Hat OpenShift (ARO), operated jointly with Microsoft. OKD is the free community distribution built from the same code, now on CentOS Stream CoreOS instead of RHCOS.

Why teams pick it

  • Batteries included: registry, builds, routes, monitoring, console and operator catalog arrive installed and tested together
  • Over-the-air upgrades for the whole stack, from the node OS to Kubernetes to platform services, driven by operators
  • Secure defaults (non-root arbitrary UIDs, dropped capabilities, SELinux) that many hand-built clusters lack
  • One platform self-managed, on ROSA or on ARO, with Red Hat support and an 18-month lifecycle per minor release (longer with Extended Update Support)

Watch out for

  • Paid: support, certified content and updates come with a Red Hat subscription; OKD is free but has no Red Hat support
  • Opinionated and large: over 100 operator-managed components, and RHCOS is the only supported OS for any node
  • Strict SCCs break images that expect to run as root or own their files; they must support an arbitrary UID in the root group
  • OpenShift-only APIs such as Routes, ImageStreams and Projects can tie manifests and habits to OpenShift

More of the Kubernetes family

What all container orchestration have in common →
K3sOpen sourceDistributionsA certified Kubernetes distribution in one small binary, built for edge, IoT and other places where a full cluster is too heavy, with SQLite or embedded etcd for state.MicroK8sOpen sourceDistributionsCanonical’s Kubernetes in one snap package: installs with one command on Linux, forms a highly available cluster by itself at three nodes, and adds features as addons.RKE2Open sourceDistributionsSUSE’s security-focused Kubernetes distribution: one binary per node, hardened defaults, FIPS-validated crypto and close alignment with upstream.Talos LinuxOpen sourceDistributionsA Linux distribution that only runs Kubernetes: immutable, minimal, with no shell or SSH, and managed entirely through an API.Amazon EKSAWSManaged servicesAWS runs the Kubernetes control plane for you; you choose how much of the worker side to hand over too.Azure Kubernetes ServiceAzureManaged servicesMicrosoft’s managed Kubernetes: a control plane that can be free, node pools of Azure VMs, and an Automatic mode that runs the nodes too.Google Kubernetes EngineGoogle CloudManaged servicesGoogle’s managed Kubernetes, the oldest one: Google runs the control plane, and in Autopilot mode the nodes too.kindOpen sourceFor local developmentKubernetes IN Docker: each cluster node is a container, so a conformant multi-node cluster starts and disappears inside a CI job.minikubeOpen sourceFor local developmentA local Kubernetes cluster for developers on Linux, macOS or Windows, in a container, a VM or on the host itself, with laptop-friendly extras.kubeadmOpen sourceToolsThe official tool for turning Linux machines you already have into a Kubernetes cluster: `kubeadm init`, then `kubeadm join`.RancherOpen sourceToolsSUSE’s open-source control plane for fleets of Kubernetes clusters: one place to create, import, secure and upgrade them.AgonesOpen sourceBuilt on itRuns dedicated multiplayer game servers on Kubernetes: keeps a fleet of them warm, hands one to each match, and never kills a server while players are on it.KlutchOpen sourceBuilt on itA young open-source control plane, built on Crossplane, that lets many application clusters order databases from one central Kubernetes cluster.

How it fits with other technologies

Create a project, run a pod and publish it with a Route · bash

oc new-project hello-openshift
oc create -f https://raw.githubusercontent.com/openshift/origin/master/examples/hello-openshift/hello-pod.json

oc expose pod/hello-openshift     # creates a Service
oc expose svc hello-openshift     # creates a Route with a hostname on the router
oc get routes

See it in a real stack

No architecture uses Red Hat OpenShift yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2010–2026

OpenShift predates Kubernetes. Red Hat bought Makara, a platform-as-a-service start-up, in late 2010 and launched OpenShift in May 2011 as a hosted PaaS for Ruby, Python, PHP and Java apps. In April 2012 it open-sourced the code as OpenShift Origin under Apache 2.0. Versions 1 and 2 already ran apps in Linux containers, but with Red Hat’s own container runtime and orchestration, in units Red Hat called gears and cartridges.

In 2013 Red Hat bet on Docker for the container format, and in early 2014 it looked for an orchestrator, evaluating Docker’s own efforts, Mesos and a home-grown design. In March 2014 Google showed Red Hat engineers the project that became Kubernetes. Red Hat rebuilt OpenShift on Docker and Kubernetes: Origin 1.0, the code behind OpenShift 3, shipped in June 2015.

In January 2018 Red Hat agreed to buy CoreOS for $250 million, gaining its Container Linux OS, the Tectonic Kubernetes platform and the Quay registry. OpenShift 4, announced in May 2019, combined them: RHCOS replaced general-purpose RHEL nodes, and operators now installed and upgraded the whole platform. The same month Microsoft and Red Hat launched ARO, and AWS and Red Hat followed with ROSA in March 2021.

Why it’s built this way

Adopt Kubernetes instead of keeping its own orchestrator
Red Hat compared Docker’s orchestration, Mesos and building its own. It chose Kubernetes for its primitives (pods, services, replication controllers, a real networking model), for Google’s experience with Borg, and for its fast-growing community.
Make the OS part of the cluster
OpenShift 4 delivers RHCOS as an immutable host image installed as a component of the cluster. The same operator-driven upgrade then covers the host and Kubernetes, and an OS update that goes wrong rolls back with a single reboot.
Operators for the platform itself
OpenShift is many containerized components. Encoding how to install and upgrade each one in an operator turned installs and upgrades of the platform, Kubernetes included, into an automated, over-the-air process.
Arbitrary non-root user IDs by default
Running every container as a random UID from the project’s range, not root, limits what a process can do if it escapes the container through a runtime bug. The cost is that images must work as any user.

Timeline

  1. 2010

    Red Hat acquires Makara, the PaaS start-up behind the first OpenShift

  2. 2011

    OpenShift launches in May as a hosted PaaS with its own container system

  3. 2012

    Code released as OpenShift Origin under Apache 2.0 in April

  4. 2015

    Origin 1.0, the code base of OpenShift 3, rebuilt on Docker and Kubernetes (June)

  5. 2018

    Red Hat agrees to buy CoreOS (January); Origin renamed OKD (August)

  6. 2019

    OpenShift 4 with RHCOS and operator-driven upgrades; Azure Red Hat OpenShift GA

  7. 2021

    Red Hat OpenShift Service on AWS (ROSA) GA in March

  8. 2026

    OKD 5.0 ships on CentOS Stream CoreOS 10 and Kubernetes 1.36

Sources14 · facts checked 6 October 2026

Improve this page on GitHub