docs/setup/managing/index.html - gerrit/www.eclipse.org/che - Git at Google



 <!-- jQuery Eclipse IP approval https://dev.eclipse.org/ipzilla/show_bug.cgi?id=10801 -->
 <script type="text/javascript" charset="utf8" src="../../../docs/assets/scripts/jquery-1.8.1.min.js"></script>

 <script type="text/javascript" charset="utf8">
   $(document).ready(function(){
     var images = document.getElementsByTagName('img');
     for (var i = 0; i < images.length; i++) {
       var image = images[i];
       var parentElement = image.parentElement;
       var a = document.createElement('a');
       if (! image.getAttribute('src').includes("logo-codenvy.svg") && ! image.getAttribute('src').includes("codenvy-contribute.svg") ){
           a.href = image.getAttribute('src');
           a.target = "_blank";
           a.appendChild(image);
           parentElement.appendChild(a);
       }
     }
   });
 </script>
 <!DOCTYPE HTML>
 <html lang="en-US">
 <head>
   <title>Managing -

       Docs
      - Eclipse Che</title>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <meta name="generator" content="Jekyll v3.5.1">
   <link rel="stylesheet" href="//fonts.googleapis.com/css?family=Lato:300,300italic,400,400italic,700,700italic,900">
   <link rel="stylesheet" href="../../../docs/assets/css/screen.css">
   <link rel="icon" type="image/x-icon" href="../../../docs/assets/imgs/favicon.ico">
   <!--[if lt IE 9]>
   <script src="/js/html5shiv.min.js"></script>
   <script src="/js/respond.min.js"></script>
   <![endif]-->
 </head>


 <body class="wrap">


 <header>
   <nav class="mobile-nav show-on-mobiles">
     <ul>

   <li class="current">
     <a href="../../../docs/index.html">Docs</a>
   </li>
   <li class="">
     <a href="../../../docs/tutorials/multi-machine/index.html">Tutorials</a>
   </li>
   <li class="">
     <a href="../../../docs/openshift/config/index.html">OpenShift</a>
   </li>
   <li>
     <a href="https://github.com/eclipse/che-docs/tree/master/src/main">GitHub</a>
   </li>
 </ul>

   </nav>
   <div class="grid">
     <div class="unit one-third center-on-mobiles">
         <a href="https://eclipse.org/che/">
           <span class="sr-only">Eclipse Che</span>
           <img src="../../../docs/assets/imgs/logo-eclipseche.svg" alt="Eclipse Che Logo"  width="249" height="115">
         </a>
     </div>
     <nav class="main-nav unit two-thirds hide-on-mobiles">
       <ul>

   <li class="current">
     <a href="../../../docs/index.html">Docs</a>
   </li>
   <li class="">
     <a href="../../../docs/tutorials/multi-machine/index.html">Tutorials</a>
   </li>
   <li class="">
     <a href="../../../docs/openshift/config/index.html">OpenShift</a>
   </li>
   <li>
     <a href="https://github.com/eclipse/che-docs/tree/master/src/main">GitHub</a>
   </li>
 </ul>

     </nav>
   </div>
 </header>


     <section class="docs">
     <div class="grid">

       <div class="docs-nav-mobile unit whole show-on-mobiles">
   <select onchange="if (this.value) window.location.href=this.value">
     <option value="">Navigate the docs…</option>


     <optgroup label="SETUP">


 <ul>


     <option value="../../../docs/index.html">Introduction</option>


     <option value="../../../docs/setup/getting-started/index.html">Getting Started&#58 Local</option>


     <option value="../../../docs/setup/getting-started-saas-cloud/index.html">Getting Started&#58 SaaS Cloud</option>


     <option value="../../../docs/setup/configuration/index.html">Configuration</option>


     <option value="../../../docs/setup/managing/index.html">Managing</option>


     <option value="../../../docs/setup/cli/index.html">CLI Reference</option>


     <option value="../../../docs/setup/glossary/index.html">Glossary</option>


     <option value="../../../docs/setup/docker/index.html">Docker Installation</option>


     <option value="../../../docs/setup/openshift/index.html">OpenShift Installation</option>


     <option value="../../../docs/setup/selenium/index.html">How to run selenium tests</option>


 </ul>


 <ul>


     <li class=""><a href="../../../docs/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/setup/getting-started/index.html">Getting Started&#58 Local</a></li>


     <li class=""><a href="../../../docs/setup/getting-started-saas-cloud/index.html">Getting Started&#58 SaaS Cloud</a></li>


     <li class=""><a href="../../../docs/setup/configuration/index.html">Configuration</a></li>


     <li class="current"><a href="../../../docs/setup/managing/index.html">Managing</a></li>


     <li class=""><a href="../../../docs/setup/cli/index.html">CLI Reference</a></li>


     <li class=""><a href="../../../docs/setup/glossary/index.html">Glossary</a></li>


     <li class=""><a href="../../../docs/setup/docker/index.html">Docker Installation</a></li>


     <li class=""><a href="../../../docs/setup/openshift/index.html">OpenShift Installation</a></li>


     <li class=""><a href="../../../docs/setup/selenium/index.html">How to run selenium tests</a></li>


 </ul>


     </optgroup>


     <optgroup label="WORKSPACE ADMINISTRATION">


 <ul>


     <option value="../../../docs/devops/intro/index.html">Introduction</option>


     <option value="../../../docs/devops/runtime-stacks/index.html">Runtime Stacks</option>


     <option value="../../../docs/devops/runtime-recipes/index.html">Runtime Recipes</option>


     <option value="../../../docs/devops/project-samples/index.html">Project Samples</option>


     <option value="../../../docs/devops/runtime-machines/index.html">Runtime Machines</option>


     <option value="../../../docs/devops/volume-mounts/index.html">Volume Mounts</option>


     <option value="../../../docs/devops/ws-agents/index.html">Workspace Agents</option>


     <option value="../../../docs/devops/workspaces-data-model/index.html">Workspace Data Model</option>


     <option value="../../../docs/devops/runtime-stacks-data-model/index.html">Runtime Stacks Data Model</option>


     <option value="../../../docs/devops/project-samples-data-model/index.html">Project Samples Data Model</option>


 </ul>


 <ul>


     <li class=""><a href="../../../docs/devops/intro/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/devops/runtime-stacks/index.html">Runtime Stacks</a></li>


     <li class=""><a href="../../../docs/devops/runtime-recipes/index.html">Runtime Recipes</a></li>


     <li class=""><a href="../../../docs/devops/project-samples/index.html">Project Samples</a></li>


     <li class=""><a href="../../../docs/devops/runtime-machines/index.html">Runtime Machines</a></li>


     <li class=""><a href="../../../docs/devops/volume-mounts/index.html">Volume Mounts</a></li>


     <li class=""><a href="../../../docs/devops/ws-agents/index.html">Workspace Agents</a></li>


     <li class=""><a href="../../../docs/devops/workspaces-data-model/index.html">Workspace Data Model</a></li>


     <li class=""><a href="../../../docs/devops/runtime-stacks-data-model/index.html">Runtime Stacks Data Model</a></li>


     <li class=""><a href="../../../docs/devops/project-samples-data-model/index.html">Project Samples Data Model</a></li>


 </ul>


     </optgroup>


     <optgroup label="USER GUIDE">


 <ul>


     <option value="../../../docs/ide/projects/index.html">Projects</option>


     <option value="../../../docs/ide/import-a-project/index.html">Import</option>


     <option value="../../../docs/ide/ssh/index.html">SSH</option>


     <option value="../../../docs/ide/sync/index.html">Local IDE Sync</option>


     <option value="../../../docs/ide/editor-settings/index.html">Editor</option>


     <option value="../../../docs/ide/intellisense/index.html">Intellisense</option>


     <option value="../../../docs/ide/commands/index.html">Commands</option>


     <option value="../../../docs/ide/git-svn/index.html">Git and SVN</option>


     <option value="../../../docs/ide/previews/index.html">Previews</option>


     <option value="../../../docs/ide/build/index.html">Build</option>


     <option value="../../../docs/ide/run/index.html">Run</option>


     <option value="../../../docs/ide/sharing/index.html">Share</option>


     <option value="../../../docs/ide/debug/index.html">Debug</option>


     <option value="../../../docs/ide/docker/index.html">Docker</option>


     <option value="../../../docs/ide/electron/index.html">Install Che Desktop Client</option>


 </ul>


 <ul>


     <li class=""><a href="../../../docs/ide/projects/index.html">Projects</a></li>


     <li class=""><a href="../../../docs/ide/import-a-project/index.html">Import</a></li>


     <li class=""><a href="../../../docs/ide/ssh/index.html">SSH</a></li>


     <li class=""><a href="../../../docs/ide/sync/index.html">Local IDE Sync</a></li>


     <li class=""><a href="../../../docs/ide/editor-settings/index.html">Editor</a></li>


     <li class=""><a href="../../../docs/ide/intellisense/index.html">Intellisense</a></li>


     <li class=""><a href="../../../docs/ide/commands/index.html">Commands</a></li>


     <li class=""><a href="../../../docs/ide/git-svn/index.html">Git and SVN</a></li>


     <li class=""><a href="../../../docs/ide/previews/index.html">Previews</a></li>


     <li class=""><a href="../../../docs/ide/build/index.html">Build</a></li>


     <li class=""><a href="../../../docs/ide/run/index.html">Run</a></li>


     <li class=""><a href="../../../docs/ide/sharing/index.html">Share</a></li>


     <li class=""><a href="../../../docs/ide/debug/index.html">Debug</a></li>


     <li class=""><a href="../../../docs/ide/docker/index.html">Docker</a></li>


     <li class=""><a href="../../../docs/ide/electron/index.html">Install Che Desktop Client</a></li>


 </ul>


     </optgroup>


     <optgroup label="PORTABLE WORKSPACES">


 <ul>


     <option value="../../../docs/chedir/getting-started/index.html">Chedir - Getting Started</option>


     <option value="../../../docs/chedir/why/index.html">Chedir - Why Chedir?</option>


     <option value="../../../docs/chedir/installation/index.html">Chedir - Installation</option>


     <option value="../../../docs/chedir/project-setup/index.html">Chedir - Project Setup</option>


     <option value="../../../docs/chedir/up-and-down/index.html">Chedir - Up and Down</option>


     <option value="../../../docs/chedir/chefiles/index.html">Chedir - Chefile</option>


     <option value="../../../docs/chedir/ssh/index.html">Chedir - SSH</option>


     <option value="../../../docs/chedir/factories/index.html">Chedir - Factories</option>


     <option value="">Error Generating Page Link. Contact Maintainer./docs/factory-getting-started/</option>


     <option value="">Error Generating Page Link. Contact Maintainer./docs/factory-creating/</option>


     <option value="">Error Generating Page Link. Contact Maintainer./docs/factory-json-reference/</option>


 </ul>


 <ul>


     <li class=""><a href="../../../docs/chedir/getting-started/index.html">Chedir - Getting Started</a></li>


     <li class=""><a href="../../../docs/chedir/why/index.html">Chedir - Why Chedir?</a></li>


     <li class=""><a href="../../../docs/chedir/installation/index.html">Chedir - Installation</a></li>


     <li class=""><a href="../../../docs/chedir/project-setup/index.html">Chedir - Project Setup</a></li>


     <li class=""><a href="../../../docs/chedir/up-and-down/index.html">Chedir - Up and Down</a></li>


     <li class=""><a href="../../../docs/chedir/chefiles/index.html">Chedir - Chefile</a></li>


     <li class=""><a href="../../../docs/chedir/ssh/index.html">Chedir - SSH</a></li>


     <li class=""><a href="../../../docs/chedir/factories/index.html">Chedir - Factories</a></li>


     <li class=""><a href="../../../docs/factory/getting-started/index.html">Factory - Getting Started</a></li>


     <li class=""><a href="../../../docs/factory/creating/index.html">Factory - Creating</a></li>


     <li class=""><a href="../../../docs/factory/json-reference/index.html">Factory - JSON Reference</a></li>


 </ul>


     </optgroup>


     <optgroup label="DEVELOPER GUIDE - REST API">


 <ul>


     <option value="../../../docs/assemblies/intro/index.html">Introduction</option>


     <option value="../../../docs/assemblies/archetype/index.html">Archetype</option>


     <option value="../../../docs/assemblies/assembly-lifecycle/index.html">Assembly Dev Lifecycle</option>


     <option value="../../../docs/assemblies/plugin-lifecycle/index.html">Plugin Lifecycle</option>


     <option value="../../../docs/assemblies/sdk-rest-apis/index.html">SDK REST APIs</option>


     <option value="../../../docs/assemblies/sdk-class-reference/index.html">SDK Class Reference</option>


     <option value="../../../docs/assemblies/sdk-dependency-injection/index.html">SDK Dependency Injection</option>


     <option value="../../../docs/assemblies/sdk-dto/index.html">SDK DTOs</option>


     <option value="../../../docs/assemblies/sdk-properties/index.html">SDK Properties</option>


     <option value="../../../docs/assemblies/sdk-code-editors/index.html">SDK Editors</option>


     <option value="../../../docs/assemblies/sdk-embed-htmljs/index.html">SDK Embedded JavaScript</option>


     <option value="../../../docs/assemblies/sdk-project-types/index.html">SDK Project Types</option>


     <option value="../../../docs/assemblies/sdk-actions/index.html">SDK Actions</option>


     <option value="../../../docs/assemblies/sdk-services/index.html">SDK Services</option>


     <option value="../../../docs/assemblies/sdk-parts/index.html">SDK Parts</option>


     <option value="../../../docs/assemblies/sdk-themes/index.html">SDK Themes</option>


     <option value="../../../docs/assemblies/sdk-custom-agents/index.html">SDK Custom Agents</option>


     <option value="../../../docs/assemblies/sdk-language-server-protocol/index.html">SDK Language Server Protocol</option>


     <option value="../../../docs/assemblies/sdk-workspace/index.html">SDK Workspace</option>


 </ul>


 <ul>


     <li class=""><a href="../../../docs/assemblies/intro/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/assemblies/archetype/index.html">Archetype</a></li>


     <li class=""><a href="../../../docs/assemblies/assembly-lifecycle/index.html">Assembly Dev Lifecycle</a></li>


     <li class=""><a href="../../../docs/assemblies/plugin-lifecycle/index.html">Plugin Lifecycle</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-rest-apis/index.html">SDK REST APIs</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-class-reference/index.html">SDK Class Reference</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-dependency-injection/index.html">SDK Dependency Injection</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-dto/index.html">SDK DTOs</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-properties/index.html">SDK Properties</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-code-editors/index.html">SDK Editors</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-embed-htmljs/index.html">SDK Embedded JavaScript</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-project-types/index.html">SDK Project Types</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-actions/index.html">SDK Actions</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-services/index.html">SDK Services</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-parts/index.html">SDK Parts</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-themes/index.html">SDK Themes</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-custom-agents/index.html">SDK Custom Agents</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-language-server-protocol/index.html">SDK Language Server Protocol</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-workspace/index.html">SDK Workspace</a></li>


 </ul>


     </optgroup>


   </select>
 </div>


       <div class="unit four-fifths">
         <article>
           <div class="improve right hide-on-mobiles">
             <a href="https://github.com/codenvy/che-docs/blob/master/src/main/_docs/setup/setup-managing.md"><i class="fa fa-pencil"></i> &nbsp;Improve this page</a>
             <!--<a href="https://github.com/eclipse/che/blob/master/docs/_docs/setup/setup-managing.md"><i class="fa fa-pencil"></i> &nbsp;Improve this page</a>-->
           </div>
           <div class="doc-title">
             <h1>Managing</h1>
             <div class="doc-title-border">
             </div>
           </div>

 <h1 id="scaling">Scaling</h1>
 <p>Eclipse Che is a workspace server. It supports the provisioning and management of numerous workspaces for users. The default configuration of Che has a single identity per server, where the identity manages IDE preferences and SSH keys for workspaces and GitHub.</p>

 <p>There are three aspects to scaling Che:</p>

 <ol>
   <li>Multi-client <a href="../../../docs/setup/managing/index.html#multi-client-collaboration">collaboration</a> within a workspace</li>
   <li>Scaling Che using a <a href="#scaling-che-using-a-che-farm">Che farm</a></li>
   <li><a href="http://codenvy.com">Upgrade to Codenvy</a></li>
 </ol>

 <h2 id="workspace-sizing">Workspace Sizing</h2>
 <p>The Che server requires 256MB RAM and can handle 1000s of concurrent workspaces.</p>

 <p>For each workspace, assume that the Che RAM overhead is 200MB-1.5GB, but it varies widely by the type of intellisense you add into the workspace. Your users will get the remaining RAM for use by their commands. So if you create a workspace with 2GB of RAM, some of that will be used by Che for its internal management of the workspace itself.</p>

 <p>The RAM variation and amount is relatively high and a function of which plug-ins are deployed into the workspace agent. For example, the Java plug-in which uses JDT core to do intellisense can require up to 1GB of RAM. If a developer is doing intensive compilation or dependency analysis, the workspace will bear the burden of providing the resources needed for these actions.</p>

 <p>Your workspace RAM can go higher if your users are creating multiple machines. Each workspace is given at least one machine. If you permit developers to launch other machines in a single workspace, those machines by default do not have a workspace agent and all of the RAM allocated to that machine will be granted to the user.</p>

 <p>Storage is consumed by:</p>

 <ol>
   <li>Images downloaded and cached by Che for creating new workspaces.</li>
   <li>Project files.</li>
   <li>Workspace snapshots, which create new images saved in a registry.</li>
 </ol>

 <p>Generally, workspace images start at 180MB. If you permit workspace snapshots, those files can grow quite significantly, especially if your developers have large dependency sets such as maven repositories that they want captured in the snapshot.</p>

 <h2 id="multi-client-collaboration">Multi-Client Collaboration</h2>
 <p>Workspaces are both portable and shared. Multiple browser clients (and humans!) can connect to a single Che server running multiple workspaces, or if you prefer, to a single workspace. Users within a single workspace can make use of the runtime and project files. Che implements a last-write-wins policy when multiple users modify the same file.</p>

 <h2 id="scaling-che-using-a-che-farm">Scaling Che Using a Che Farm</h2>

 <p><img src="../../../docs/assets/imgs/che_farm.png" alt="che_farm.png" /></p>

 <p>You can deploy Che in a farm with an Nginx router. Each user would be provisioned their own Che instance, either running on its own port in a VM. In this configuration, each user can have their own workspaces and identity profile. Note that since Che exports two IP addresses, one for Che and another for the workspace machine running Docker, your router will need to manage traffic for all possible routes between browser, Che and machines.</p>

 <h2 id="scaling-che-with-codenvy">Scaling Che with Codenvy</h2>
 <p>Your Eclipse Che workspaces and plug-ins will work within <a href="http://codenvy.com">Codenvy</a>. Codenvy is a multi-tenant, multi-user and elastic cloud installed locally or used as a SaaS:</p>

 <ul>
   <li>Workspace distribution with an embedded Docker Swarm</li>
   <li>Operational solutions for monitoring, scaling, upgrading and archiving workspaces</li>
   <li>Team management, permissions and resource policy management tools</li>
   <li>User authentication, single-sign on, and LDAP</li>
   <li>Self-service user registration</li>
 </ul>

 <p><img src="../../../docs/assets/imgs/scale_codenvy.png" alt="scale_codenvy.png" /></p>

 <p>Codenvy uses Docker to install, configure, and update various internal services. This creates a simple management interface for administrators with flexibility on how many physical nodes to allocate along with the resource policy management that is applied to users and accounts.</p>

 <h1 id="upgrading">Upgrading</h1>
 <p>Upgrading Che is done by downloading a <code class="highlighter-rouge">eclipse/che-cli:&lt;version&gt;</code> that is newer than the version you currently have installed. You can run <code class="highlighter-rouge">eclipse/che-cli version</code> to see the list of available versions that you can upgrade to.</p>

 <p>For example, if you have 5.0.0-M2 installed and want to upgrade to 5.0.0-M8, then:</p>

 <div class="highlighter-rouge"><pre class="highlight"><code># Get the new version of Che
 docker pull eclipse/che-cli:5.0.0-M8

 # You now have two eclipse/che-cli images (one for each version)
 # Perform an upgrade - use the new image to upgrade old installation
 docker run &lt;volume-mounts&gt; eclipse/che-cli:5.0.0-M8 upgrade
 </code></pre>
 </div>

 <p>The upgrade command has numerous checks to prevent you from upgrading Che if the new image and the old version are not compatible. In order for the upgrade procedure to advance, the CLI image must be newer that the version in <code class="highlighter-rouge">/instance/che.ver</code>.</p>

 <p>The upgrade process:</p>

 <ol>
   <li>Performs a version compatibility check</li>
   <li>Downloads new Docker images that are needed to run the new version of Che</li>
   <li>Stops Che if it is currently running</li>
   <li>Triggers a maintenance window</li>
   <li>Backs up your installation</li>
   <li>Initializes the new version</li>
   <li>Starts Che</li>
   <li>Important! If <code class="highlighter-rouge">CHE_PREDEFINED_STACKS_RELOAD__ON__START</code> is set to false, stacks packaged into new binaries won’t be saved into a database.</li>
 </ol>

 <h1 id="backup">Backup</h1>
 <p>You can run <code class="highlighter-rouge">che backup</code> to create a copy of the relevant configuration information, user data, projects, and workspaces. We do not save workspace snapshots as part of a routine backup exercise. You can run <code class="highlighter-rouge">che restore</code> to recover Che from a particular backup snapshot. The backup is saved as a TAR file that you can keep in your records. You can then use <code class="highlighter-rouge">che restore</code> to recover your user data and configuration.</p>

 <h1 id="security">Security</h1>
 <p>Eclipse Che is designed as a single identity system to be used by an individual or small team working in a trusted environment. The following outlines some of the security capabilities and known gaps in Che.</p>

 <h2 id="securing-che-ports">Securing Che Ports</h2>
 <p>Firewall rules can be added to prevent access to ports that shouldn’t be externally accessible. Refer to <a href="../../../docs/setup/configuration/index.html#topology">network topology docs</a> for additional information on ports.</p>

 <p>When a remote user (outside the local network) requires access to Che, firewall rules can be setup to allow only certain ip-addresses access.</p>

 <h2 id="limiting-che-ports">Limiting Che Ports</h2>
 <p>Eclipse Che uses Docker to power its workspaces. Docker uses the <a href="https://en.wikipedia.org/wiki/Ephemeral_port">ephemeral port range</a> when exposing ports for services running in the container. So when a Tomcat server is started on port 8080 inside a Che workspace Docker automatically selects an available port from the ephemeral range at runtime to map to that Tomcat instance.</p>

 <p>Docker will select its ports from anywhere in the ephemeral range. If you wish to reduce the size of the ephemeral range in order to improve security you can do so, however, keep in mind that each Che workspace will use at least 2 ports plus whatever ports are required for the services the user adds to their workspace.</p>

 <p>Limiting the ephemeral range can only be done at the host level - you can read more about it (and some of the risks in doing so) here: http://www.ncftp.com/ncftpd/doc/misc/ephemeral_ports.html</p>

 <p>To change the ephemeral range:</p>

 <ul>
   <li>On Linux: http://www.ncftp.com/ncftpd/doc/misc/ephemeral_ports.html#Linux</li>
   <li>On Windows: http://www.ncftp.com/ncftpd/doc/misc/ephemeral_ports.html#Windows</li>
 </ul>

 <h2 id="securing-a-workspace-from-the-che-host">Securing a Workspace from the Che Host</h2>
 <p>It is possible for admins to mount files from your server’s host file system to be available to your users within their workspaces with the <code class="highlighter-rouge">CHE_WORKSPACE_VOLUME</code> and <code class="highlighter-rouge">CHE_DOCKER_PRIVILEGED</code> parameters are potential secrity risks as you open the possiblity of sending host-specific files into a workspace or giving a workspace user access to the host system.  These options are useful for certain development situations but should be minimized to increase security to the host system whenever possible.</p>

 <h2 id="workspace-permissions">Workspace Permissions</h2>
 <p>Eclipse Che is a single identity system. All users accessing a Che server share an identity and user preferences. There are no identity-based permissions since all users share the same identity.  Users have access and control over all workspace environments.</p>

 <p>For a simple separation of workspaces for small development teams, without requiring workspace permissions, administrators can create separate Che server for each user. Each server, if ran on same host, would need to be setup on different ports using the <code class="highlighter-rouge">CHE_PORT</code> environment variable and different data folders mounted <code class="highlighter-rouge">:/data</code>.</p>

 <p>Codenvy provides an implementation of Eclipse Che that is multi-tenant, multi-user with distributed access and permissions controls for teams. Each user has a different login which enables access controls, workspace collaboration, and other forms of sharing. You can install Codenvy with a CLI that is nearly identical to Che with <code class="highlighter-rouge">docker run codenvy/cli start</code>. Learn more at <a href="https://codenvy.com">https://codenvy.com</a>.</p>

 <h2 id="authenticated-access">Authenticated Access</h2>
 <p>The Che server itself is unauthenticated. Che is extensible allowing different dashboard front ends or proxies to implement authenticated access to the Che server.</p>

 <p>Codenvy provides an implementation of Eclipse Che that has authentication, multi-user and multi-tenant capabilities.</p>

 <h2 id="https">HTTP/S</h2>
 <p>HTTPS is not provided by Eclipse Che. It would require a more complex architecture with multi-service deployments, making Che more challenging for developers and small teams to use. Codenvy gives you the option of running the system with HTTP/S and providing your own SSL certificate.</p>

         </article>
       </div>

       <div class="unit one-fifth hide-on-mobiles">
   <aside>


     <h4>SETUP</h4>


 <ul>


     <li class=""><a href="../../../docs/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/setup/getting-started/index.html">Getting Started&#58 Local</a></li>


     <li class=""><a href="../../../docs/setup/getting-started-saas-cloud/index.html">Getting Started&#58 SaaS Cloud</a></li>


     <li class=""><a href="../../../docs/setup/configuration/index.html">Configuration</a></li>


     <li class="current"><a href="../../../docs/setup/managing/index.html">Managing</a></li>


     <li class=""><a href="../../../docs/setup/cli/index.html">CLI Reference</a></li>


     <li class=""><a href="../../../docs/setup/glossary/index.html">Glossary</a></li>


     <li class=""><a href="../../../docs/setup/docker/index.html">Docker Installation</a></li>


     <li class=""><a href="../../../docs/setup/openshift/index.html">OpenShift Installation</a></li>


     <li class=""><a href="../../../docs/setup/selenium/index.html">How to run selenium tests</a></li>


 </ul>


     <h4>WORKSPACE ADMINISTRATION</h4>


 <ul>


     <li class=""><a href="../../../docs/devops/intro/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/devops/runtime-stacks/index.html">Runtime Stacks</a></li>


     <li class=""><a href="../../../docs/devops/runtime-recipes/index.html">Runtime Recipes</a></li>


     <li class=""><a href="../../../docs/devops/project-samples/index.html">Project Samples</a></li>


     <li class=""><a href="../../../docs/devops/runtime-machines/index.html">Runtime Machines</a></li>


     <li class=""><a href="../../../docs/devops/volume-mounts/index.html">Volume Mounts</a></li>


     <li class=""><a href="../../../docs/devops/ws-agents/index.html">Workspace Agents</a></li>


     <li class=""><a href="../../../docs/devops/workspaces-data-model/index.html">Workspace Data Model</a></li>


     <li class=""><a href="../../../docs/devops/runtime-stacks-data-model/index.html">Runtime Stacks Data Model</a></li>


     <li class=""><a href="../../../docs/devops/project-samples-data-model/index.html">Project Samples Data Model</a></li>


 </ul>


     <h4>USER GUIDE</h4>


 <ul>


     <li class=""><a href="../../../docs/ide/projects/index.html">Projects</a></li>


     <li class=""><a href="../../../docs/ide/import-a-project/index.html">Import</a></li>


     <li class=""><a href="../../../docs/ide/ssh/index.html">SSH</a></li>


     <li class=""><a href="../../../docs/ide/sync/index.html">Local IDE Sync</a></li>


     <li class=""><a href="../../../docs/ide/editor-settings/index.html">Editor</a></li>


     <li class=""><a href="../../../docs/ide/intellisense/index.html">Intellisense</a></li>


     <li class=""><a href="../../../docs/ide/commands/index.html">Commands</a></li>


     <li class=""><a href="../../../docs/ide/git-svn/index.html">Git and SVN</a></li>


     <li class=""><a href="../../../docs/ide/previews/index.html">Previews</a></li>


     <li class=""><a href="../../../docs/ide/build/index.html">Build</a></li>


     <li class=""><a href="../../../docs/ide/run/index.html">Run</a></li>


     <li class=""><a href="../../../docs/ide/sharing/index.html">Share</a></li>


     <li class=""><a href="../../../docs/ide/debug/index.html">Debug</a></li>


     <li class=""><a href="../../../docs/ide/docker/index.html">Docker</a></li>


     <li class=""><a href="../../../docs/ide/electron/index.html">Install Che Desktop Client</a></li>


 </ul>


     <h4>PORTABLE WORKSPACES</h4>


 <ul>


     <li class=""><a href="../../../docs/chedir/getting-started/index.html">Chedir - Getting Started</a></li>


     <li class=""><a href="../../../docs/chedir/why/index.html">Chedir - Why Chedir?</a></li>


     <li class=""><a href="../../../docs/chedir/installation/index.html">Chedir - Installation</a></li>


     <li class=""><a href="../../../docs/chedir/project-setup/index.html">Chedir - Project Setup</a></li>


     <li class=""><a href="../../../docs/chedir/up-and-down/index.html">Chedir - Up and Down</a></li>


     <li class=""><a href="../../../docs/chedir/chefiles/index.html">Chedir - Chefile</a></li>


     <li class=""><a href="../../../docs/chedir/ssh/index.html">Chedir - SSH</a></li>


     <li class=""><a href="../../../docs/chedir/factories/index.html">Chedir - Factories</a></li>


     <li class=""><a href="../../../docs/factory/getting-started/index.html">Factory - Getting Started</a></li>


     <li class=""><a href="../../../docs/factory/creating/index.html">Factory - Creating</a></li>


     <li class=""><a href="../../../docs/factory/json-reference/index.html">Factory - JSON Reference</a></li>


 </ul>


     <h4>DEVELOPER GUIDE - REST API</h4>


 <ul>


     <li class=""><a href="../../../docs/assemblies/intro/index.html">Introduction</a></li>


     <li class=""><a href="../../../docs/assemblies/archetype/index.html">Archetype</a></li>


     <li class=""><a href="../../../docs/assemblies/assembly-lifecycle/index.html">Assembly Dev Lifecycle</a></li>


     <li class=""><a href="../../../docs/assemblies/plugin-lifecycle/index.html">Plugin Lifecycle</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-rest-apis/index.html">SDK REST APIs</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-class-reference/index.html">SDK Class Reference</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-dependency-injection/index.html">SDK Dependency Injection</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-dto/index.html">SDK DTOs</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-properties/index.html">SDK Properties</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-code-editors/index.html">SDK Editors</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-embed-htmljs/index.html">SDK Embedded JavaScript</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-project-types/index.html">SDK Project Types</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-actions/index.html">SDK Actions</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-services/index.html">SDK Services</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-parts/index.html">SDK Parts</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-themes/index.html">SDK Themes</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-custom-agents/index.html">SDK Custom Agents</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-language-server-protocol/index.html">SDK Language Server Protocol</a></li>


     <li class=""><a href="../../../docs/assemblies/sdk-workspace/index.html">SDK Workspace</a></li>


 </ul>


   </aside>
 </div>


       <div class="clear"></div>

     </div>
   </section>


   <script>
   var anchorForId = function (id) {
     var anchor = document.createElement("a");
     anchor.className = "header-link";
     anchor.href      = "#" + id;
     anchor.innerHTML = "<span class=\"sr-only\">Permalink</span><i class=\"fa fa-link\"></i>";
     anchor.title = "Permalink";
     return anchor;
   };

   var linkifyAnchors = function (level, containingElement) {
     var headers = containingElement.getElementsByTagName("h" + level);
     for (var h = 0; h < headers.length; h++) {
       var header = headers[h];

       if (typeof header.id !== "undefined" && header.id !== "") {
         header.appendChild(anchorForId(header.id));
       }
     }
   };

   document.onreadystatechange = function () {
     if (this.readyState === "complete") {
       var contentBlock = document.getElementsByClassName("artik")[0] || document.getElementsByClassName("openshift")[0] || document.getElementsByClassName("tutorials")[0] || document.getElementsByClassName("docs")[0] || document.getElementsByClassName("news")[0];
       if (!contentBlock) {
         return;
       }
       for (var level = 1; level <= 6; level++) {
         linkifyAnchors(level, contentBlock);
       }
     }
   };
 </script>


 </body>
 </html>