+ - {{ $description }} -
-- {{ $tagline }} -
- -
+
+
+ 
+ 
+
+
+
+ + Stop using a different policy language, policy model, and policy + API for every product and service you use. Use OPA for a unified + toolset and framework for policy across the cloud native stack. +
++ Whether for one service or for all your services, use OPA to + decouple policy from the service's code so you can release, + analyze, and review policies (which security and compliance teams + love) without sacrificing availability or performance. +
+Created By
+ 
+ Kubernetes
+ 
+ Envoy
+ 
+ Application
+
+
+{
+ "apiVersion": "admission.k8s.io/v1beta1",
+ "kind": "AdmissionReview",
+ "request": {
+ "kind": {
+ "group": "",
+ "kind": "Pod",
+ "version": "v1"
+ },
+ "object": {
+ "metadata": {
+ "name": "myapp"
+ },
+ "spec": {
+ "containers": [
+ {
+ "image": "nginx",
+ "name": "nginx-frontend"
+ },
+ {
+ "image": "mysql",
+ "name": "mysql-backend"
+ }
+ ]
+ }
+ }
+ }
+}
+
+
+
+
+
+
+
+
+{
+ "apiVersion": "admission.k8s.io/v1beta1",
+ "kind": "AdmissionReview",
+ "request": {
+ "kind": {
+ "group": "extensions",
+ "kind": "Ingress",
+ "version": "v1beta1"
+ },
+ "object": {
+ "metadata": {
+ "name": "prod",
+ "namespace": "bar"
+ },
+ "spec": {
+ "rules": [
+ {
+ "host": "initech.com",
+ "http": {
+ "paths": [
+ {
+ "backend": {
+ "serviceName": "banking",
+ "servicePort": 443
+ },
+ "path": "/finance"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ }
+}
+
+
+
+
+
+
+
+
+
+{
+ "attributes": {
+ "destination": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 8000
+ },
+ "address": "172.17.0.8"
+ }
+ }
+ }
+ },
+ "request": {
+ "http": {
+ "headers": {
+ ":authority": "example-app",
+ ":method": "GET",
+ ":path": "/pets",
+ "user-agent": "Wget",
+ "x-forwarded-proto": "http",
+ "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"
+ },
+ "host": "example-app",
+ "id": "8910035251488566126",
+ "method": "GET",
+ "path": "/pets",
+ "protocol": "HTTP/1.1"
+ }
+ },
+ "source": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 54292
+ },
+ "address": "172.17.0.6"
+ }
+ }
+ }
+ }
+ },
+ "parsed_path": [
+ "pets"
+ ]
+}
+
+
+
+
+
+
+
+
+
+{
+ "attributes": {
+ "destination": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 8000
+ },
+ "address": "172.17.0.8"
+ }
+ }
+ }
+ },
+ "request": {
+ "http": {
+ "headers": {
+ ":authority": "example-app",
+ ":method": "GET",
+ ":path": "/pets/owners",
+ "user-agent": "Wget",
+ "x-forwarded-client-cert": "By=spiffe://domain.test/db-server;Hash=331f2f4eb2a1729fa4e0f46c8c663786098151ae571fed7b66680e970f6a0f94;URI=spiffe://domain.test/frontend",
+ "x-forwarded-proto": "http",
+ "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"
+ },
+ "host": "example-app",
+ "id": "8910035251488566126",
+ "method": "GET",
+ "path": "/pets/owners",
+ "protocol": "HTTP/1.1"
+ }
+ },
+ "source": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 54292
+ },
+ "address": "172.17.0.6"
+ }
+ }
+ }
+ }
+ },
+ "parsed_path": [
+ "pets",
+ "owners"
+ ]
+}
+
+
+
+
+
+
+
+
+
+{
+ "method": "PUT",
+ "owner": "bob@hooli.com",
+ "path": [
+ "pets",
+ "pet113-987"
+ ],
+ "user": "alice@hooli.com"
+}
+
+
+
+
+
+
+
+
+
+{
+ "pet_list": [
+ {
+ "breed": "St. Bernard",
+ "name": "Cujo",
+ "up_for_adoption": false
+ },
+ {
+ "breed": "Collie",
+ "name": "Lassie",
+ "up_for_adoption": true
+ }
+ ],
+ "token": "eyJ1IjoiSFMyNTYiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWxpY2UiLCJlbXBsb3llZSI6dHJ1ZSwibmFtZSI6IkFsaWNlIFNtaXRoIn0.vMBYEW8VK9XM7yPkKTu1C3Gy1tOq1A0d4-xYMkkRpEc"
+}
+
+
+
+
+
+
+
+
+ Kubernetes
+
+
+{
+ "apiVersion": "admission.k8s.io/v1beta1",
+ "kind": "AdmissionReview",
+ "request": {
+ "kind": {
+ "group": "",
+ "kind": "Pod",
+ "version": "v1"
+ },
+ "object": {
+ "metadata": {
+ "name": "myapp"
+ },
+ "spec": {
+ "containers": [
+ {
+ "image": "nginx",
+ "name": "nginx-frontend"
+ },
+ {
+ "image": "mysql",
+ "name": "mysql-backend"
+ }
+ ]
+ }
+ }
+ }
+}
+
+
+
+
+
+
+
+
+{
+ "apiVersion": "admission.k8s.io/v1beta1",
+ "kind": "AdmissionReview",
+ "request": {
+ "kind": {
+ "group": "extensions",
+ "kind": "Ingress",
+ "version": "v1beta1"
+ },
+ "object": {
+ "metadata": {
+ "name": "prod",
+ "namespace": "bar"
+ },
+ "spec": {
+ "rules": [
+ {
+ "host": "initech.com",
+ "http": {
+ "paths": [
+ {
+ "backend": {
+ "serviceName": "banking",
+ "servicePort": 443
+ },
+ "path": "/finance"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ }
+}
+
+
+
+
+
+
+
+ 
+ Envoy
+
+
+{
+ "attributes": {
+ "destination": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 8000
+ },
+ "address": "172.17.0.8"
+ }
+ }
+ }
+ },
+ "request": {
+ "http": {
+ "headers": {
+ ":authority": "example-app",
+ ":method": "GET",
+ ":path": "/pets",
+ "user-agent": "Wget",
+ "x-forwarded-proto": "http",
+ "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"
+ },
+ "host": "example-app",
+ "id": "8910035251488566126",
+ "method": "GET",
+ "path": "/pets",
+ "protocol": "HTTP/1.1"
+ }
+ },
+ "source": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 54292
+ },
+ "address": "172.17.0.6"
+ }
+ }
+ }
+ }
+ },
+ "parsed_path": [
+ "pets"
+ ]
+}
+
+
+
+
+
+
+
+
+
+{
+ "attributes": {
+ "destination": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 8000
+ },
+ "address": "172.17.0.8"
+ }
+ }
+ }
+ },
+ "request": {
+ "http": {
+ "headers": {
+ ":authority": "example-app",
+ ":method": "GET",
+ ":path": "/pets/owners",
+ "user-agent": "Wget",
+ "x-forwarded-client-cert": "By=spiffe://domain.test/db-server;Hash=331f2f4eb2a1729fa4e0f46c8c663786098151ae571fed7b66680e970f6a0f94;URI=spiffe://domain.test/frontend",
+ "x-forwarded-proto": "http",
+ "x-request-id": "4d75f8d5-983f-4ec5-92bb-d27e620b4921"
+ },
+ "host": "example-app",
+ "id": "8910035251488566126",
+ "method": "GET",
+ "path": "/pets/owners",
+ "protocol": "HTTP/1.1"
+ }
+ },
+ "source": {
+ "address": {
+ "Address": {
+ "SocketAddress": {
+ "PortSpecifier": {
+ "PortValue": 54292
+ },
+ "address": "172.17.0.6"
+ }
+ }
+ }
+ }
+ },
+ "parsed_path": [
+ "pets",
+ "owners"
+ ]
+}
+
+
+
+
+
+
+
+
+ Application
+
+
+{
+ "method": "PUT",
+ "owner": "bob@hooli.com",
+ "path": [
+ "pets",
+ "pet113-987"
+ ],
+ "user": "alice@hooli.com"
+}
+
+
+
+
+
+
+
+
+
+package application.authz
+
+# Everyone can see adopted pets
+allowed_pets[pet] {
+ some i
+ pet := input.pet_list[i]
+ pet.up_for_adoption == true
+}
+
+# Employees can see all pets.
+allowed_pets[pet] {
+ [header, payload, signature] := io.jwt.decode(input.token)
+ payload.employee == true
+ some i
+ pet := input.pet_list[i]
+}
+
+
+
+
+
+
+
+ Declarative. Express policy in + a high-level, + declarative language that promotes safe, + performant, fine-grained controls. Use a language + purpose-built for policy in a world where JSON is + pervasive. Iterate, traverse hierarchies, and apply + 50+ built-ins like string manipulation and JWT + decoding to declare the policies you want enforced.
+Context-aware. Leverage + external information to + write the policies you really care about. Stop + inventing roles that represent complex relationships + that years down the road no one will understand. + Instead, write logic that adapts to the world around + it and attach that logic to the systems that need it.
+
+ 
+ Deploy OPA as a separate process on the same + host as your service. Integrate OPA by changing + your service’s code, importing an OPA-enabled + library, or using a network proxy integrated with OPA.
+
+
+ 
+ Embed OPA policies into your service. Integrate OPA as a Go + library + that evaluates policy, or integrate a WebAssembly runtime + and use OPA + to compile policy to WebAssembly instructions.
+
+ 
+ 
+ 
+ OPA embraces policy-as-code, complete with tools that help people + use and understand the policies they put + in + place. Integrated development environments, testing, profiling, + coverage, automated performance tuning, and + hot + reloading aren’t just things you need for programming--you need them + for policy too, and OPA delivers.
+
+ 
- {{ $tagline }} -
- -Open Policy Agent (OPA) is a general-purpose policy engine with uses ranging from authorization and - admission control to data filtering. OPA provides greater flexibility and expressiveness than hard-coded - service logic or ad-hoc domain-specific languages. And it comes with powerful tooling to help you get - started.
- -Here are just a few examples of what you can do with OPA:
- - -
-
- # Kubernetes Admission Control Invariants - -package kubernetes.invariants - -import data.kubernetes.ingresses -import data.kubernetes.namespaces - -# --------------------------------------------------------------------- -# Ingress Invariants - -# Generates a list of non-compliant ingresses identified by `namespace` -# and ingress specification `name`. -violations[{ - "namespace": namespace, - "name": name, - "message": "ingress hostname must match whitelist" -}] { - ingress := ingresses[namespace][name] - host := ingress.spec.rules[_].host - not contains(whitelist[namespace], host) -} - -# Generates a list of allowed hostnames per namespace. -whitelist[namespace] = hosts { - obj := namespaces[namespace] - annotations := obj.metadata.annotations - annotation := annotations["acmecorp.com/hostname-whitelist"] - hosts := json.unmarshal(annotation) -} - -# --------------------------------------------------------------------- -# Helpers - -# Checks if `list` includes an element matching `item`. -contains(list, item) { - list[_] = item -}-
-
- # HTTP API Authorization - -package acmecorp.authz - -default allow = false - -# Allow people to read their own salaries. -allow { - input.method = "GET" - input.path = ["salaries", employee_id] - input.user = employee_id -} - -# Also allow managers to read the salaries of people they manage. -allow { - input.method = "GET" - input.path = ["salaries", employee_id] - input.user = data.manager_of[employee_id] -}-
-
- # Fine-Grained SSH Authorization - -package ssh.fine_grained - -# Allow users in the "dev" organization to SSH into hosts if they -# possess a certificate proving they are assigned to an application -# running on the host. -allow { - # Extract the X.509 certificate provided in the policy query. - certs := crypto.x509.parse_certificates(input.certificates) - - # Check that the user is part of the "dev" organization for an app - # running on this host. - certs[i].Subject.Organization[j] == data.host_info.apps[_] - certs[i].Subject.OrganizationalUnit[j] == "dev" - - # Check the certificate's validity period at the time of login. - time.now_ns() >= certs[i].NotBefore - time.now_ns() <= certs[i].NotAfter -}-
-
- # Partial Evaluation - -package app.filtering - -# --------------------------------------------------------------------- -# Data Filtering - -# Allow users to see their own posts. -posts[post] { - post := data.posts[_] - post.owner = input.subject.name -} - -# Allow users to see posts from their own department -# that they have sufficient clearance for. -posts[post] { - post := data.posts[_] - post.department = input.subject.department - post.security_level <= input.subject.clearance_level -} - -# Example Output: -# -# Conditions (1) -# -------------- -# data.posts[x].owner = "bob" -# -# Conditions (2) -# -------------- -# data.posts[x].department = "ops" -# data.posts[x].clearance_level <= 3 - --
`s get reset. However, we also reset the\n// bottom margin to use `rem` units instead of `em`.\np {\n margin-top: 0;\n margin-bottom: $paragraph-margin-bottom;\n}\n\n// Abbreviations\n//\n// 1. Duplicate behavior to the data-* attribute for our tooltip plugin\n// 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari.\n// 3. Add explicit cursor to indicate changed behavior.\n// 4. Remove the bottom border in Firefox 39-.\n// 5. Prevent the text-decoration to be skipped.\n\nabbr[title],\nabbr[data-original-title] { // 1\n text-decoration: underline; // 2\n text-decoration: underline dotted; // 2\n cursor: help; // 3\n border-bottom: 0; // 4\n text-decoration-skip-ink: none; // 5\n}\n\naddress {\n margin-bottom: 1rem;\n font-style: normal;\n line-height: inherit;\n}\n\nol,\nul,\ndl {\n margin-top: 0;\n margin-bottom: 1rem;\n}\n\nol ol,\nul ul,\nol ul,\nul ol {\n margin-bottom: 0;\n}\n\ndt {\n font-weight: $dt-font-weight;\n}\n\ndd {\n margin-bottom: .5rem;\n margin-left: 0; // Undo browser default\n}\n\nblockquote {\n margin: 0 0 1rem;\n}\n\nb,\nstrong {\n font-weight: $font-weight-bolder; // Add the correct font weight in Chrome, Edge, and Safari\n}\n\nsmall {\n @include font-size(80%); // Add the correct font size in all browsers\n}\n\n//\n// Prevent `sub` and `sup` elements from affecting the line height in\n// all browsers.\n//\n\nsub,\nsup {\n position: relative;\n @include font-size(75%);\n line-height: 0;\n vertical-align: baseline;\n}\n\nsub { bottom: -.25em; }\nsup { top: -.5em; }\n\n\n//\n// Links\n//\n\na {\n color: $link-color;\n text-decoration: $link-decoration;\n background-color: transparent; // Remove the gray background on active links in IE 10.\n\n @include hover {\n color: $link-hover-color;\n text-decoration: $link-hover-decoration;\n }\n}\n\n// And undo these styles for placeholder links/named anchors (without href)\n// which have not been made explicitly keyboard-focusable (without tabindex).\n// It would be more straightforward to just use a[href] in previous block, but that\n// causes specificity issues in many other styles that are too complex to fix.\n// See https://github.com/twbs/bootstrap/issues/19402\n\na:not([href]):not([tabindex]) {\n color: inherit;\n text-decoration: none;\n\n @include hover-focus {\n color: inherit;\n text-decoration: none;\n }\n\n &:focus {\n outline: 0;\n }\n}\n\n\n//\n// Code\n//\n\npre,\ncode,\nkbd,\nsamp {\n font-family: $font-family-monospace;\n @include font-size(1em); // Correct the odd `em` font sizing in all browsers.\n}\n\npre {\n // Remove browser default top margin\n margin-top: 0;\n // Reset browser default of `1em` to use `rem`s\n margin-bottom: 1rem;\n // Don't allow content to break outside\n overflow: auto;\n}\n\n\n//\n// Figures\n//\n\nfigure {\n // Apply a consistent margin strategy (matches our type styles).\n margin: 0 0 1rem;\n}\n\n\n//\n// Images and content\n//\n\nimg {\n vertical-align: middle;\n border-style: none; // Remove the border on images inside links in IE 10-.\n}\n\nsvg {\n // Workaround for the SVG overflow bug in IE10/11 is still required.\n // See https://github.com/twbs/bootstrap/issues/26878\n overflow: hidden;\n vertical-align: middle;\n}\n\n\n//\n// Tables\n//\n\ntable {\n border-collapse: collapse; // Prevent double borders\n}\n\ncaption {\n padding-top: $table-cell-padding;\n padding-bottom: $table-cell-padding;\n color: $table-caption-color;\n text-align: left;\n caption-side: bottom;\n}\n\nth {\n // Matches default `
`s get reset. However, we also reset the\n// bottom margin to use `rem` units instead of `em`.\np {\n margin-top: 0;\n margin-bottom: $paragraph-margin-bottom;\n}\n\n// Abbreviations\n//\n// 1. Duplicate behavior to the data-* attribute for our tooltip plugin\n// 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari.\n// 3. Add explicit cursor to indicate changed behavior.\n// 4. Remove the bottom border in Firefox 39-.\n// 5. Prevent the text-decoration to be skipped.\n\nabbr[title],\nabbr[data-original-title] { // 1\n text-decoration: underline; // 2\n text-decoration: underline dotted; // 2\n cursor: help; // 3\n border-bottom: 0; // 4\n text-decoration-skip-ink: none; // 5\n}\n\naddress {\n margin-bottom: 1rem;\n font-style: normal;\n line-height: inherit;\n}\n\nol,\nul,\ndl {\n margin-top: 0;\n margin-bottom: 1rem;\n}\n\nol ol,\nul ul,\nol ul,\nul ol {\n margin-bottom: 0;\n}\n\ndt {\n font-weight: $dt-font-weight;\n}\n\ndd {\n margin-bottom: .5rem;\n margin-left: 0; // Undo browser default\n}\n\nblockquote {\n margin: 0 0 1rem;\n}\n\nb,\nstrong {\n font-weight: $font-weight-bolder; // Add the correct font weight in Chrome, Edge, and Safari\n}\n\nsmall {\n @include font-size(80%); // Add the correct font size in all browsers\n}\n\n//\n// Prevent `sub` and `sup` elements from affecting the line height in\n// all browsers.\n//\n\nsub,\nsup {\n position: relative;\n @include font-size(75%);\n line-height: 0;\n vertical-align: baseline;\n}\n\nsub { bottom: -.25em; }\nsup { top: -.5em; }\n\n\n//\n// Links\n//\n\na {\n color: $link-color;\n text-decoration: $link-decoration;\n background-color: transparent; // Remove the gray background on active links in IE 10.\n\n @include hover {\n color: $link-hover-color;\n text-decoration: $link-hover-decoration;\n }\n}\n\n// And undo these styles for placeholder links/named anchors (without href)\n// which have not been made explicitly keyboard-focusable (without tabindex).\n// It would be more straightforward to just use a[href] in previous block, but that\n// causes specificity issues in many other styles that are too complex to fix.\n// See https://github.com/twbs/bootstrap/issues/19402\n\na:not([href]):not([tabindex]) {\n color: inherit;\n text-decoration: none;\n\n @include hover-focus {\n color: inherit;\n text-decoration: none;\n }\n\n &:focus {\n outline: 0;\n }\n}\n\n\n//\n// Code\n//\n\npre,\ncode,\nkbd,\nsamp {\n font-family: $font-family-monospace;\n @include font-size(1em); // Correct the odd `em` font sizing in all browsers.\n}\n\npre {\n // Remove browser default top margin\n margin-top: 0;\n // Reset browser default of `1em` to use `rem`s\n margin-bottom: 1rem;\n // Don't allow content to break outside\n overflow: auto;\n}\n\n\n//\n// Figures\n//\n\nfigure {\n // Apply a consistent margin strategy (matches our type styles).\n margin: 0 0 1rem;\n}\n\n\n//\n// Images and content\n//\n\nimg {\n vertical-align: middle;\n border-style: none; // Remove the border on images inside links in IE 10-.\n}\n\nsvg {\n // Workaround for the SVG overflow bug in IE10/11 is still required.\n // See https://github.com/twbs/bootstrap/issues/26878\n overflow: hidden;\n vertical-align: middle;\n}\n\n\n//\n// Tables\n//\n\ntable {\n border-collapse: collapse; // Prevent double borders\n}\n\ncaption {\n padding-top: $table-cell-padding;\n padding-bottom: $table-cell-padding;\n color: $table-caption-color;\n text-align: left;\n caption-side: bottom;\n}\n\nth {\n // Matches default `
`s get reset. However, we also reset the\n// bottom margin to use `rem` units instead of `em`.\np {\n margin-top: 0;\n margin-bottom: $paragraph-margin-bottom;\n}\n\n// Abbreviations\n//\n// 1. Duplicate behavior to the data-* attribute for our tooltip plugin\n// 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari.\n// 3. Add explicit cursor to indicate changed behavior.\n// 4. Remove the bottom border in Firefox 39-.\n// 5. Prevent the text-decoration to be skipped.\n\nabbr[title],\nabbr[data-original-title] { // 1\n text-decoration: underline; // 2\n text-decoration: underline dotted; // 2\n cursor: help; // 3\n border-bottom: 0; // 4\n text-decoration-skip-ink: none; // 5\n}\n\naddress {\n margin-bottom: 1rem;\n font-style: normal;\n line-height: inherit;\n}\n\nol,\nul,\ndl {\n margin-top: 0;\n margin-bottom: 1rem;\n}\n\nol ol,\nul ul,\nol ul,\nul ol {\n margin-bottom: 0;\n}\n\ndt {\n font-weight: $dt-font-weight;\n}\n\ndd {\n margin-bottom: .5rem;\n margin-left: 0; // Undo browser default\n}\n\nblockquote {\n margin: 0 0 1rem;\n}\n\nb,\nstrong {\n font-weight: $font-weight-bolder; // Add the correct font weight in Chrome, Edge, and Safari\n}\n\nsmall {\n @include font-size(80%); // Add the correct font size in all browsers\n}\n\n//\n// Prevent `sub` and `sup` elements from affecting the line height in\n// all browsers.\n//\n\nsub,\nsup {\n position: relative;\n @include font-size(75%);\n line-height: 0;\n vertical-align: baseline;\n}\n\nsub { bottom: -.25em; }\nsup { top: -.5em; }\n\n\n//\n// Links\n//\n\na {\n color: $link-color;\n text-decoration: $link-decoration;\n background-color: transparent; // Remove the gray background on active links in IE 10.\n\n @include hover {\n color: $link-hover-color;\n text-decoration: $link-hover-decoration;\n }\n}\n\n// And undo these styles for placeholder links/named anchors (without href)\n// which have not been made explicitly keyboard-focusable (without tabindex).\n// It would be more straightforward to just use a[href] in previous block, but that\n// causes specificity issues in many other styles that are too complex to fix.\n// See https://github.com/twbs/bootstrap/issues/19402\n\na:not([href]):not([tabindex]) {\n color: inherit;\n text-decoration: none;\n\n @include hover-focus {\n color: inherit;\n text-decoration: none;\n }\n\n &:focus {\n outline: 0;\n }\n}\n\n\n//\n// Code\n//\n\npre,\ncode,\nkbd,\nsamp {\n font-family: $font-family-monospace;\n @include font-size(1em); // Correct the odd `em` font sizing in all browsers.\n}\n\npre {\n // Remove browser default top margin\n margin-top: 0;\n // Reset browser default of `1em` to use `rem`s\n margin-bottom: 1rem;\n // Don't allow content to break outside\n overflow: auto;\n}\n\n\n//\n// Figures\n//\n\nfigure {\n // Apply a consistent margin strategy (matches our type styles).\n margin: 0 0 1rem;\n}\n\n\n//\n// Images and content\n//\n\nimg {\n vertical-align: middle;\n border-style: none; // Remove the border on images inside links in IE 10-.\n}\n\nsvg {\n // Workaround for the SVG overflow bug in IE10/11 is still required.\n // See https://github.com/twbs/bootstrap/issues/26878\n overflow: hidden;\n vertical-align: middle;\n}\n\n\n//\n// Tables\n//\n\ntable {\n border-collapse: collapse; // Prevent double borders\n}\n\ncaption {\n padding-top: $table-cell-padding;\n padding-bottom: $table-cell-padding;\n color: $table-caption-color;\n text-align: left;\n caption-side: bottom;\n}\n\nth {\n // Matches default `
- 
- 
- 
- 
-