The rkt enter command in the default systemd/nspawn flavor lacks isolation features.

Processes spawned by the rkt enter command run with all capabilities, without seccomp filtering, and aren’t limited by cgroups. This allows processes spawned by rkt enter to break out of the pod with relative ease. A process, for example, can mount the host filesystem device.

This issue was reported to RedHat & CoreOS according to the instructions here. Three CVE IDs were assigned:

• CVE-2019-10144: processes run with rkt enter are given all capabilities during stage 2
• CVE-2019-10145: processes run with rkt enter do not have seccomp filtering during stage 2
• CVE-2019-10147: processes run with rkt enter are not limited by cgroups
  during stage 2

RedHat does not plan on fixing these issues, and so I report them here.