Q:

How does yum with Red Hat Network Subscription work inside the rhel Docker images?

Red Hat Enterprise Linux 7 includes official support for running Docker containers, and Red Hat offer a set of official rhel Docker images.  An interesting feature of these images is that packages can be installed via the host's Red Hat Network Subscription without having to perform any configuration within the container.
To quote https://access.redhat.com/articles/881893#createimage:

"For the current Red Hat Docker release, the default RHEL 7 Docker
  image you pull from Red Hat will be able to draw on RHEL 7
  entitlements available from the host system. So, as long as your
  Docker host is properly subscribed and the repositories are enabled
  that you need to get the software you want in your container (and have
  Internet access from your Docker host), you should be able to install
  packages from RHEL 7 software repositories."

My concern is that the mechanism by which this is achieved is rather opaque.  When starting a new container with the rhel7.1 image, for example, it is possible to run yum install foo without even configuring the http proxy environment variables.  Without understanding this mechanism, the system administrator is potentially at the mercy of unknown interactions between the host system, the Docker daemon, and running containers.  This also suggests that the normal isolation between the host and container is in some way compromised (albeit in a benign fashion).
To put a point on it: How is this subscription support achieved, and is it dependent on the custom build of the Docker daemon provided by Red Hat via the Subscription Network?

A:

Red Hat carries a patch to docker called the 'secrets' patch which mounts the entitlement information into containers when they are run.
You can see the a better description of the patch and a link to the upstream PR in the projectatomic/docker repo:
https://github.com/projectatomic/docker/tree/docker-1.13.1-rhel#add-rhel-super-secrets-patchpatch
Note, you'll need to select one of the branches (the link goes to the 'docker-1.3.1-rhel' branch) to see all the carried patch information.

