## 3.1 zCX instance security 

In this section, we discuss security issues to do with a zCX instance. The next chapter discusses security within the zCX instance. 

A key concept to grasp is that zCX instances run as standard started tasks, which are normal address spaces on z/OS LPAR. 

Associated with a zCX instance are the typical artifacts, which are associated with any started task that runs on z/OS. You must manage these artifacts as you would manage any other process on z/OS. 

## 3.1.1 Implications of zCX running as a started task 

For a zCX instance, you must consider the following issues: 

GLYPH<SM590000> RACF user IDs and groups that you must administer and manage 

GLYPH<SM590000> zFS data sets 

GLYPH<SM590000> USS directories and files 

GLYPH<SM590000> zFS files and VSAM linear data sets 

GLYPH<SM590000> TCPIP 

GLYPH<SM590000> z/OSMF 

As mentioned, zCX instances run as standard started tasks on z/OS. 

This means that all the normal rules that apply to a started task on z/OS apply to zCX that runs as a started task. 

z/OS uses mechanisms to ensure that no process running in an address space can access any other part of z/OS outside that address space unless authorized to do so. 

This means that even if a process running in a Docker container in a zCX started task was running as a UNIX root user ID, that would not allow it to circumvent z/OS security controls to somehow access something else in the z/OS LPAR outside the zCX instance address space. 

Access into and out of the zCX started task is done via TCPIP. 

There is no capability for an application in a Docker container in a zCX started task to run a program to somehow access memory outside the started task address space. 

## Virtual machine 

When started, the zCX instance allocates real memory and runs the Linux operating system as a virtual machine inside this memory. Because of this, the z/OS architecture prevents any program running inside this virtual machine from being able to access any memory outside of the memory that is allocated. 

## 3.1.2 zCX RACF planning 

There are three main issues that relate to the management of zCX instances: 

GLYPH<SM590000> Using z/OSMF to provision zCX instances 

GLYPH<SM590000> Running zCX instances as started tasks 

GLYPH<SM590000> User IDs to administer the running of Docker containers inside a zCX instance 

Associated with the first two issues are the use of the following entities: 

