Red Hat Enterprise Linux 7 includes official support for running Docker containers, and Red Hat offer a set of official rhel Docker images. An interesting feature of these images is that packages can be installed via the host's Red Hat Network Subscription without having to perform any configuration within the container.
"For the current Red Hat Docker release, the default RHEL 7 Docker image you pull from Red Hat will be able to draw on RHEL 7 entitlements available from the host system. So, as long as your Docker host is properly subscribed and the repositories are enabled that you need to get the software you want in your container (and have Internet access from your Docker host), you should be able to install packages from RHEL 7 software repositories."
My concern is that the mechanism by which this is achieved is rather opaque. When starting a new container with the rhel7.1 image, for example, it is possible to run
yum install foo without even configuring the http proxy environment variables. Without understanding this mechanism, the system administrator is potentially at the mercy of unknown interactions between the host system, the Docker daemon, and running containers. This also suggests that the normal isolation between the host and container is in some way compromised (albeit in a benign fashion).
To put a point on it: How is this subscription support achieved, and is it dependent on the custom build of the Docker daemon provided by Red Hat via the Subscription Network?