Ensure aufs storage driver is not used

MediumLevel 1Automateddocker

Description

The aufs storage driver is deprecated, unsupported in current kernels and known to cause kernel crashes. The audit reads the storage driver from docker info.

How it is checked

Audit method: Shell command

shell

d=$(docker info --format '{{.Driver}}') || exit 1; [ "$d" = aufs ] && echo "$d" || echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Migrate to the overlay2 storage driver: set "storage-driver": "overlay2" in /etc/docker/daemon.json, re-pull or rebuild images, and restart the Docker daemon.

Properties

Operating systems: Any
Tags: dockerdaemonstorage
Reference: CIS Docker Benchmark v1.9.0 - 2.6 Ensure aufs storage driver is not used

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker