# Ensure all signed artifacts are validated

- Source: https://support.icompaas.com/support/solutions/articles/62000234387-ensure-all-signed-artifacts-are-validated
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   Level 1  
    

Description:

Docker stores container data by default under /var/lib/docker. To prevent issues such as disk space exhaustion, it is recommended to create a separate partition for Docker data. This ensures Docker containers are isolated from the main system and do not affect system performance.  

Rationale:

Storing Docker data on a separate partition ensures that Docker containers do not fill up the root file system, preventing potential downtime or system issues due to lack of disk space. A dedicated partition improves resource management and security by isolating Docker-related files from other system files.  

Impact:

Pros:  

-   Ensures better resource management by separating Docker data from the host file system.  
    
-   Prevents Docker data from consuming all available space on the root filesystem.  
    

Cons:  

-   Requires partitioning or resizing disk space, which could cause downtime if not planned properly.  
    
-   Some configurations may require additional setup for mounting and ensuring Docker persists across reboots.  
    

Default Value:

By default, Docker uses /var/lib/docker which is typically stored on the same partition as the root file system.

Pre-requisites:

-   Disk partitioning tools available (e.g., LVM, fdisk).  
    
-   Administrative privileges to modify disk partitions and mount points.  
    

Remediation:

Test Plan:

Using AWS Console:

1.  Navigate to the EC2 instance running Docker.  
    
2.  Use df -h to check the current disk usage and confirm that /var/lib/docker is on a separate partition.
3.  Ensure the partition is not shared with other files or directories by reviewing the mount or lsblk output.

Using AWS CLI:

1.  Connect to the EC2 instance running Docker.  
    
2.  Run df -h to verify the disk partitions and ensure that Docker is using a dedicated partition.

Implementation Plan:

Using AWS Console:

1.  Log in to the EC2 instance.  
    
2.  Create a new partition using LVM or a tool like fdisk and mount it to /var/lib/docker.  
    
3.  Modify /etc/fstab to ensure the new partition is mounted on reboot.
4.  Restart Docker to ensure the changes take effect:  
    

sudo systemctl restart docker

Using AWS CLI:

1.  Use SSM to remotely create a new partition and mount it for Docker storage.  
    
2.  Execute the following command to partition and mount the disk:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo lvcreate -L 10G -n docker\_data docker\_vg && sudo mkfs.ext4 /dev/docker\_vg/docker\_data && sudo mount /dev/docker\_vg/docker\_data /var/lib/docker && sudo systemctl restart docker"\]'

Backout Plan:

Using AWS Console:

1.  Connect to the EC2 instance.  
    
2.  Unmount the partition using sudo umount /var/lib/docker.  
    
3.  Optionally, remove the partition or restore the default Docker storage configuration by editing /etc/fstab and rebooting.
4.  Restart Docker:  
    

sudo systemctl restart docker

Using AWS CLI:

1.  Use SSM to remove the partition and revert Docker storage to the default location.  
    
2.  Execute the following command:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sudo umount /var/lib/docker && sudo rm -rf /var/lib/docker/\* && sudo systemctl restart docker"\]'
    

References:

-   CIS Docker Benchmark v1.7  
    
-   Docker Storage Documentation: [https://docs.docker.com/storage/](https://docs.docker.com/storage/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.