The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.