The new Volumes field in SCCs allows an administrator full control over which volume plug-ins may be specified.

The new ReadOnlyRootFilesystem field in SCCs allows an administrator to force containers to run with a read-only root file system.

Service accounts are now supported for the router and registry:

The web console uses a brand new theme that changes the look and feel of the navigation, tabs, and other page elements. See Project Overviews for details.

A new About page provides developers with information about the product version, oc CLI download locations, and a quick access to their current token to login using oc login. See CLI Downloads for details.

You can now add or edit resource constraints for your containers during Add to Project or later from the deployment configuration.

A form-based editor for build configurations has been added for modifying commonly edited fields directly from the web console.

The following commands have been added to oc create, allowing more objects to be created directly using the CLI (instead of passing it a file or JSON/YAML):

Builds can now be supplied with input files from unrelated images. Previously, all input to a build had to come from the builder image itself, or a Git repository. It is now possible to specify additional images and paths within those images to use as an input to a build for things like external dependencies.

Use the --source-image=<image> and --source-image-path=<source>:<destination> flags with the oc new-build command to specify images.

The example shown below injects the /usr/lib/jenkins/jenkins.war file out of the image currently tagged with jenkins:latest into the installed-apps directory of the build input:

apiVersion: v1
kind: BuildConfig
metadata:
  name: imagedockerbuild
spec:
  source:
    images:
    - from:
        kind: ImageStreamTag
        name: jenkins:latest
      paths:
      - destinationDir: installed-apps/
        sourcePath: /usr/lib/jenkins/jenkins.war

Ensure that you set an image change trigger for jenkins:latest if you want to rebuild every time that image is updated.

You can now import images from Docker v2 registries that are authenticated via Basic or Token credentials. To import, create a secret in your project based on a .docker/config.json or .dockercfg file:

$ oc secrets new hub .dockerconfigjson=$HOME/.docker/config.json
Created secret/hub
$ oc import-image auth-protected/image-from-dockerhub
The import completed successfully.

Name:       image-from-dockerhub
Created:    Less than a second ago

Tag     Spec                                 Created
latest  default/image-from-dockerhub:latest  Less than a second ago ...

When importing, all secrets in your project of those types will be checked. To exclude a secret from being a candidate for importing, use the openshift.io/image.excludeSecret annotation set to true:

$ oc annotate secret/hub openshift.io/image.excludeSecret=true

Image stream tags can be set to be automatically imported from remote repositories when they change (public or private). OpenShift Enterprise will periodically query the remote registry and check for updates depending on the configuration the administrator sets. By default, images will be checked every 15 minutes.

To set an image to be imported automatically, use the --scheduled flag with the oc tag command:

$ oc tag --source=docker redis:latest myredis:latest --scheduled
Tag myredis:latest set to import redis:latest periodically.

You can see which images are being scheduled using oc describe is myredis.

Administrators can control whether scheduling is enabled, the polling interval, and the rate at which images can be imported via the imagePolicyConfig section in the /etc/origin/master/master-config.yaml file.

The integrated Docker registry now supports image pullthrough, allowing you to tag a remote image into OpenShift Enterprise and directly pull it from the integrated registry as if it were already pushed to the OpenShift Enterprise registry. If the remote registry is configured to use content-offload (sending back a temporary redirect URL to the actual binary contents), that value will be passed through the OpenShift Enterprise registry and down to the Docker daemon, avoiding the need to proxy the binary contents.

To try pullthrough, tag an image from the DockerHub and then pull it from the integrated registry:

$ oc tag --source=docker redis:latest redis:local
$ oc get is redis
NAME      DOCKER REPO                     TAGS     UPDATED
mysql     172.30.1.5:5000/default/redis   local    Less than a second ago

# log into your local docker registry
$ docker pull 127.30.1.5:5000/default/redis:local
Using default tag: local
Trying to pull repository 127.30.1.5:5000/default/redis ... latest: Pulling from 127.30.1.5:5000/default/redis
47d44cb6f252: Pull complete
838c1c5c4f83: Pull complete
5764f0a31317: Pull complete
60e65a8e4030: Pull complete
449f8db3c25a: Pull complete
a6b6487c42f6: Pull complete
Digest: sha256:c541c66a86b0715bfbb89c5515929268196b642551beccf8fbd452bb00170cde
Status: Downloaded newer image for 127.30.1.5:5000/default/redis:local

You can use pullthrough with private images; the integrated registry will use the same secret you imported the image with to fetch content from the remote registry.

oc rsh now launches /bin/sh, not /bin/bash. To have the old behavior, run:

$ oc rsh <name> -- /bin/bash