Does a function container running within the same POD of iron-function engine on Kubernetes?

[sss0350]

Hi there, I've installed iron-function on openshift within a project (namespace). Please help me clarify one thing : I can see core iron-function running pod in my project , but was curious about how a faas "function" will be trigger by iron. Does iron use host OS's docker engine , and docker run "function" container directly on OS level, rather than running "function" container within its' own pod? If this is true (and it seems to be true) it's a bit odd to me, since this function container is totally bypass POD level security policy. Could you tell me detail steps of how a function will be trigger at run-time, if someone access it thru rest. Thank you very much.

Gatsby

[sss0350]

I saw a similar discussion onopenwhisk project (https://github.com/apache/incubator-openwhisk-deploy-kube/issues/110), it seems there are two approaches of creating containers 1) DockerContainerFactory 2) KubernetesContainerFactory , does it mean ironfunction might use DockerContainerFactory way to create containers?