The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.
https://github.com/projectatomic/oci-register-machine/pull/22
https://bugzilla.redhat.com/show_bug.cgi?id=1360634
http://www.securityfocus.com/bid/92143