The container platform runtime must prohibit the instantiation of container images without explicit privileged status.

Controlling access to those users and roles responsible for container image instantiation reduces the risk of untested or potentially malicious containers from being executed within the platform and on the hosting system. This access may be separate from the access required to install container images into the registry and those access requirements required to perform patch management and upgrades within the container platform. Explicit privileges (escalated or administrative privileges) provide the regular user with explicit capabilities and control that exceeds the rights of a regular user.

Review the container platform runtime configuration to determine if only accounts given specific container instantiation privileges can execute the container image instantiation process.

Attempt to instantiate a container image using an account that does not have the proper privileges to execute the process.

If container images can be instantiated using an account without the proper privileges, this is a finding.

Configure the container platform runtime to prohibit the instantiation of container images without explicit container image instantiation privileges given to users.