CIS compliance scans fail on container hosts with "Ensure no ungrouped files or directories exist"

Issue

• When running security scanning software that checks CIS compliance on Red Hat Enterprise Linux hosts running container tooling such as docker or podman, security scans may fail with:

Ensure no ungrouped files or directories exist

• The directories and files explicitly listed as problematic by the above rule are part of container filesystems or images, notably within the graphRoot paths on the host.
  • For root users, this is usually /var/lib/docker or /var/lib/containers by default.
  • For rootless users, this is usually $HOME/.local/containers by default.