+SYS.1.6.A17 Running Containers Without Privileges (S)

SYS.1.6.A17 Running Containers Without Privileges (S)

A container runtime and any instantiated containers SHOULD only be executed by a non-privileged system account that does not have (and cannot gain) elevated rights to the container service or host operating system. The container runtime SHOULD be encapsulated by additional measures, such as using the virtualisation extensions of CPUs.

If containers are to take over tasks of the host system in exceptional cases, privileges on the host system SHOULD be limited to the minimum necessary. Exceptions SHOULD be adequately documented.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information