+SYS.1.6.A17 Running Containers Without Privileges (S)

SYS.1.6.A17 Running Containers Without Privileges (S)

A container runtime and any instantiated containers SHOULD only be executed by a non-privileged system account that does not have (and cannot gain) elevated rights to the container service or host operating system. The container runtime SHOULD be encapsulated by additional measures, such as using the virtualisation extensions of CPUs.

If containers are to take over tasks of the host system in exceptional cases, privileges on the host system SHOULD be limited to the minimum necessary. Exceptions SHOULD be adequately documented.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy

Prepojené úlohy

Prepojenia
blocks G 0.14 Interception of Information / Espionage
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.39 Malware
blocks G 0.46 Loss of Integrity of Sensitive Information