# AWX requirement of privileged container **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [October 7, 2018, 4:19am UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739 "2018-10-07T04:19:53Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Idan\_Bidani](https://avatars.discourse-cdn.com/v4/letter/i/b3f665/32.png) [@Idan\_Bidani](https://forum.ansible.com/u/Idan_Bidani)\ **Post date:** [October 7, 2018, 4:19am UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/1 "2018-10-07T04:19:53Z")
Hi, I’m setting up AWX on Openshift for POC(very likely it will be adopted) and I noticed that it requires SCC privileged permissions. Do you know what features requires this and whether it is possible to deploy without it? Thanks in advance, Idan ---
**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\ **Post date:** [October 7, 2018, 1:10pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/2 "2018-10-07T13:10:57Z")
[https://docs.ansible.com/ansible-tower/latest/html/userguide/security.html](https://docs.ansible.com/ansible-tower/latest/html/userguide/security.html) Bubble wrap requires privileged containers and is on by default. You can disable it via the job isolation toggle. I looked to the docs above. ---
**Author:** ![Idan\_Bidani](https://avatars.discourse-cdn.com/v4/letter/i/b3f665/32.png) [@Idan\_Bidani](https://forum.ansible.com/u/Idan_Bidani)\ **Post date:** [October 8, 2018, 12:35am UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/3 "2018-10-08T00:35:13Z")
Great thank you for clarifying that. ---
**Author:** ![ngonzal](https://avatars.discourse-cdn.com/v4/letter/n/ecc23a/32.png) [@ngonzal](https://forum.ansible.com/u/ngonzal)\ **Post date:** [October 8, 2018, 6:33pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/4 "2018-10-08T18:33:42Z")
So to confirm, there’s no way to deploy without SCC privileged permissions? My openshift admins wanted some specifics on what permissions were needed before they would allow that (I think they’re looking to create a custom role). ---
**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\ **Post date:** [October 8, 2018, 6:49pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/5 "2018-10-08T18:49:58Z")
Idan, I encourage you to reach out to a Red Hat representative so they can help you POC Tower. ngonzal, There is no supported way to deploy without SCC privileged permissions. That being said, I can think of how you can make it work. You need to set privileged: false in installer/roles/kubernetes/templates/deployment.yml.j2 That will get the container deployed. Then you need to disable bubblewrap like I describe above. ---
**Author:** ![Idan\_Bidani](https://avatars.discourse-cdn.com/v4/letter/i/b3f665/32.png) [@Idan\_Bidani](https://forum.ansible.com/u/Idan_Bidani)\ **Post date:** [October 9, 2018, 7:08pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/6 "2018-10-09T19:08:01Z")
Hi Chris, Thanks for your help, I got AWX deployed successfully on our Openshift. Like you said, I had to update the deployment.yml.j2 and disable “Job Isolation” and it deployed successfully. For production deployments we will need to keep that enabled, we will review this later. ngonzal, you can review my working deployment scripts [https://github.com/iplaman/awx/commit/1d396060a94ca2c3f774834dddf4169d84da1a64](https://github.com/iplaman/awx/commit/1d396060a94ca2c3f774834dddf4169d84da1a64) Thanks, Idan ---
**Author:** ![Graham\_Neville](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@Graham\_Neville](https://forum.ansible.com/u/Graham_Neville)\ **Post date:** [December 14, 2018, 8:53pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/7 "2018-12-14T20:53:48Z")
Has there been any progress on this? bubblewrap is something we want to have enabled but it only works with privileged containers which isn't allowed on our cluster. Has anyone been able to work around this? ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [December 17, 2018, 3:28pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/8 "2018-12-17T15:28:07Z")
Nothing has changed about this as there’s been no real movement from the bubblewrap team… if that changes or another tool like bwrap comes along then we’ll take another look. ---
**Author:** ![afeller](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@afeller](https://forum.ansible.com/u/afeller)\ **Post date:** [December 26, 2018, 1:20pm UTC](https://forum.ansible.com/t/awx-requirement-of-privileged-container/28739/9 "2018-12-26T13:20:40Z")
Hey Chris, Any sense on appetite to enhance AWX install to conditionalize whether it configures AWX with privileged expectations? _(considering whether to PR but don’t want to waste time if project just going to decide not to accept it)_ Regards, Andy