Ensure aufs storage driver is not used

中级别 1自动化docker

说明

The aufs storage driver is deprecated, unsupported in current kernels and known to cause kernel crashes. The audit reads the storage driver from docker info.

检查方式

审计方法: Shell 命令

shell

d=$(docker info --format '{{.Driver}}') || exit 1; [ "$d" = aufs ] && echo "$d" || echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Migrate to the overlay2 storage driver: set "storage-driver": "overlay2" in /etc/docker/daemon.json, re-pull or rebuild images, and restart the Docker daemon.

属性

操作系统: 任意
标签: dockerdaemonstorage
参考: CIS Docker Benchmark v1.9.0 - 2.6 Ensure aufs storage driver is not used

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target docker