---
title: The Docker local storage partition should be separate from other partitions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The Docker local storage partition
  should be separate from other partitions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The Docker local storage partition should be separate from other partitions
Classification:complianceFramework:cis-dockerControl:1.1.1 
## Description{% #description %}

The Docker data root, `/var/lib/docker` by default, should be a mount point of its own.

## Rationale{% #rationale %}

Docker keeps its images, containers, and volumes in the data root, which can grow fast. When the data root is on its own partition or logical volume, a full data root leaves the rest of the host running.

## Audit{% #audit %}

Find the data root of the daemon and check that it is a mount point:

```bash
mountpoint -- "$(docker info -f '{{ .DockerRootDir }}')"
```

Datadog reads the data root from the daemon and the mount points from `/proc/1/mounts`, the mounts of the host's init. It passes the rule when the data root is a mount point and fails it otherwise. With user namespace remapping, the daemon keeps its data in a subdirectory of the data root named after the remapped user and group, and Datadog checks the data root above it.

## Remediation{% #remediation %}

On a new host, create a partition or logical volume for `/var/lib/docker` before installing Docker. On an existing host, create the volume, stop Docker, copy the data root onto it, mount it in `/etc/fstab`, and start Docker again.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The data root is a directory of the root or `/var` filesystem.

## References{% #references %}

1. [https://projectatomic.io/docs/docker-storage-recommendation/](https://projectatomic.io/docs/docker-storage-recommendation/)
1. [https://docs.docker.com/engine/storage/](https://docs.docker.com/engine/storage/)