3.1 zCX instance security 3.1.1 Implications of zCX running as a started task 3.1.2 zCX RACF planning In this section, we discuss security issues to do with a zCX instance. The next chapter  discusses security within the zCX instance. A key concept to grasp is that zCX instances run as standard started tasks, which are normal  address spaces on z/OS LPAR. Associated with a zCX instance are the typical artifacts, which are associated with any started  task that runs on z/OS. You must manage these artifacts as you would manage any other  process on z/OS. For a zCX instance, you must consider the following issues: GLYPH<SM590000> RACF user IDs and groups that you must administer and manage GLYPH<SM590000> zFS data sets GLYPH<SM590000> USS directories and files GLYPH<SM590000> zFS files and VSAM linear data sets GLYPH<SM590000> TCPIP GLYPH<SM590000> z/OSMF As mentioned, zCX instances run as standard started tasks on z/OS. This means that all the normal rules that apply to a started task on z/OS apply to zCX that  runs as a started task. z/OS uses mechanisms to ensure that no process running in an address space can access  any other part of z/OS outside that address space unless authorized to do so. This means that even if a process running in a Docker container in a zCX started task was  running as a UNIX root user ID, that would not allow it to circumvent z/OS security controls to  somehow access something else in the z/OS LPAR outside the zCX instance address space. Access into and out of the zCX started task is done via TCPIP. There is no capability for an application in a Docker container in a zCX started task to run a  program to somehow access memory outside the started task address space. When started, the zCX instance allocates real memory and runs the Linux operating system  as a virtual machine inside this memory. Because of this, the z/OS architecture prevents any  program running inside this virtual machine from being able to access any memory outside of  the memory that is allocated. Virtual machine There are three main issues that relate to the management of zCX instances: GLYPH<SM590000> Using z/OSMF to provision zCX instances GLYPH<SM590000> Running zCX instances as started tasks GLYPH<SM590000> User IDs to administer the running of Docker containers inside a zCX instance Associated with the first two issues are the use of the following entities: 42  Getting started with z/OS Container Extensions