How can a non-root user validate the nerdctl installed by root user is trusted?

[zibinpan]

In the scenario that the root user cannot be trusted, how can a non-root user validate the nerdctl installed by root user is trusted? Otherwise, it's in danger when the non-root user building its container.

[AkihiroSuda]

In the scenario that the root user cannot be trusted

In this scenario no program can be trusted.

[zibinpan]

Can the non-root user scan the file of nerdctl to validate its consistency? Of course, the root user is required to open necessary authority for non-root user to do this scanning.

[AkihiroSuda]

No, because the root user may intercept the syscalls etc. to fake up the scanning result

[zibinpan]

Thanks. But I am very confusing that if I want the rooter to build a TEE (Trusted execution environment) container, how can it be trusted? Or there doesn't exist any totally trusted TEE technique?