OpenShift must contain only container images for those capabilities being offered by the container platform.
An XCCDF Rule
Description
<VulnDiscussion>Allowing container images to reside within the container platform registry that are not essential to the capabilities being offered by the container platform becomes a potential security risk. By allowing these nonessential container images to exist, the possibility for accidental instantiation exists. The images may be unpatched, not supported, or offer nonapproved capabilities. Those images for customer services are considered essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-257538r960963_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Remove any images from the container registry that are not required for the functionality of the system by executing the following:
oc delete image <IMAGE_NAME> -n <IMAGE_NAMESPACE>