A Study on the "1.1 - Create a Separated Partition for Containers" of C.I.S

The reason for "Create a separate partition" is that the availability of the system is considered when capacity is high.

Therefore, Cis recommends "Create a separate partition" for availability, and considering other security issues, it is necessary to consider the access rights of the mounting location.

This is because if the user is not intended to mount a particular location, it could lead to an infringement.

Procedure for mounting is as follows.

ref : https://github.com/nearform/devops/blob/master/packer/securing-docker/scripts/volume.sh

sudo mkfs -t ext4 /dev/xvdf sudo mkdir /mnt/data-store sudo mount /dev/xvdf /mnt/data-store echo "/var/lib/docker /mnt/data-store bind defaults,bind 0 0" | sudo tee -a /etc/fstab