TMA-DOCKER-2.6
Ensure aufs storage driver is not used
MediumLevel 1Automateddocker
Description
The aufs storage driver is deprecated, unsupported in current kernels and known to cause kernel crashes. The audit reads the storage driver from docker info.
How it is checked
Audit method: Shell command
shell
d=$(docker info --format '{{.Driver}}') || exit 1; [ "$d" = aufs ] && echo "$d" || echo compliant- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Migrate to the overlay2 storage driver: set "storage-driver": "overlay2" in /etc/docker/daemon.json, re-pull or rebuild images, and restart the Docker daemon.
Properties
- Operating systems
- Any
- Tags
- dockerdaemonstorage
- Reference
- CIS Docker Benchmark v1.9.0 - 2.6 Ensure aufs storage driver is not used
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target docker