← Back to Mirantis Kubernetes Engine Security Technical Implementation Guide

V-260926

CAT II (Medium)

MKE must use a non-AUFS storage driver.

Rule ID

SV-260926r966135_rule

STIG

Mirantis Kubernetes Engine Security Technical Implementation Guide

Version

V2R1

CCIs

CCI-000382

Discussion

The aufs storage driver is an old driver based on a Linux kernel patch-set that is unlikely to be merged into the main Linux kernel. aufs driver is also known to cause some serious kernel crashes. aufs only has legacy support from Docker. Most importantly, aufs is not a supported driver in many Linux distributions using latest Linux kernels.

Check Content

The default storage driver for MCR is overlay2. To confirm this has not been changed via CLI: 

As a trusted user on the underlying host operating system, execute the following command:

docker info | grep -e "Storage Driver:"

If the Storage Driver setting contains *aufs or *btrfs, then this is a finding. If the above command returns no values, this is not a finding.

Fix Text

Modify Storage Driver setting.

Via CLI as a trusted user on the underlying host operating system:

If the daemon.json file does not exist, it must be created.

"/etc/docker/daemon.json"

Edit the "/etc/docker/daemon.json" file and set the "storage-driver" property to a value that is not "aufs" or "btrfs".
{
  "storage-driver": "overlay2"
}

Restart the Docker daemon by executing the following:

sudo systemctl restart docker