MKE must use a non-AUFS storage driver.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-260926	CNTR-MK-000600	SV-260926r966135_rule		Medium

Description
The aufs storage driver is an old driver based on a Linux kernel patch-set that is unlikely to be merged into the main Linux kernel. aufs driver is also known to cause some serious kernel crashes. aufs only has legacy support from Docker. Most importantly, aufs is not a supported driver in many Linux distributions using latest Linux kernels.

STIG	Date
Mirantis Kubernetes Engine Security Technical Implementation Guide	2024-06-17

Details

Check Text ( C-64655r966133_chk )
The default storage driver for MCR is overlay2. To confirm this has not been changed via CLI: As a trusted user on the underlying host operating system, execute the following command: docker info \| grep -e "Storage Driver:" If the Storage Driver setting contains aufs or btrfs, then this is a finding. If the above command returns no values, this is not a finding.

Fix Text (F-64563r966134_fix)
Modify Storage Driver setting. Via CLI as a trusted user on the underlying host operating system: If the daemon.json file does not exist, it must be created. "/etc/docker/daemon.json" Edit the "/etc/docker/daemon.json" file and set the "storage-driver" property to a value that is not "aufs" or "btrfs". { "storage-driver": "overlay2" } Restart the Docker daemon by executing the following: sudo systemctl restart docker

Fix Text (F-64563r966134_fix)

Modify Storage Driver setting.

Via CLI as a trusted user on the underlying host operating system:

If the daemon.json file does not exist, it must be created.

"/etc/docker/daemon.json"

Edit the "/etc/docker/daemon.json" file and set the "storage-driver" property to a value that is not "aufs" or "btrfs".
{
"storage-driver": "overlay2"
}

Restart the Docker daemon by executing the following:

sudo systemctl restart docker