Does a function container running within the same POD of iron-function engine on Kubernetes?

[sss0350]

Hi there,
I've installed iron-function on openshift within a project (namespace).
Please help me clarify one thing :
I can see core iron-function running pod in my project , but was curious about how a faas "function" will be trigger by iron. Does iron use host OS's docker engine , and docker run "function" container directly on OS level, rather than running "function" container within its' own pod? If this is true (and it seems to be true)
it's a bit odd to me, since this function container is totally bypass POD level security policy.
Could you tell me detail steps of how a function will be trigger at run-time, if someone access it thru rest.
Thank you very much.

Gatsby

[sss0350]

I saw a similar discussion onopenwhisk project (apache/openwhisk-deploy-kube#110), it seems there are two approaches of creating containers 1) DockerContainerFactory 2) KubernetesContainerFactory , does it mean ironfunction might use DockerContainerFactory way to create containers?