1. Proposed title of this feature request  

  [RFE] Custom strategy creates Vulnerability

3. What is the nature and description of the request?  

As Per OSE docs and in practice usability of Custom strategy creates possible vulnerability:

So user can create custom builder image and get access to underlying nodes resources via Docker socket. 
From: https://docs.openshift.com/enterprise/3.0/admin_guide/securing_builds.html#overview
Builds in OpenShift are run in privileged containers that have access to the Docker daemon socket. As a security measure, it is recommended to limit who can run builds and the strategy that is used for those builds. Custom builds are inherently less safe than Source builds, given that they can execute any code in the build with potentially full access to the node’s Docker socket. Docker build permission should also be granted with caution as a vulnerability in the Docker build logic could result in a privileges being granted on the host node.

We would require additional functionality to eliminate this risk: 
Solution would be to enable functionality to have "Approved Builder Image list for Custom Strategy".
We should be able to configure Particular images to be used with custom strategy.  So user will not be able to pass their own images for custom strategy. 

Second option would be ability to add new build strategies, based on custom strategy.


Recreate:
o create custom builder image with sleep 9999 as main command (CMD or RUN)
o create deployment and build config with:
"spec": {
			    "serviceAccount": "builder",
				"strategy": {
					"type": "Custom",
					"customStrategy": {
						"forcePull": true,
						"exposeDockerSocket": true,


o create app and rsh to the pod:
and docker ps exposes all containers running on node. 

standard option would be to disable custom strategy this via policy but we need it to implement custom workflows (like build from nexus, or promotion client). we would require ability to create list of approved images for custom strategies or ability to create our own strategies.



7. Is there already an existing RFE upstream or in Red Hat Bugzilla?  
No  

    
10. List any affected packages or components.  
Openshift Enterprise 3.2 , builder image