Docker Engine 29 silently ignores container disk quotas under new default backend
Docker Engine 29 changed its default image store from the classic overlay2 graphdriver to the containerd snapshotter for new installations. A hands-on comparison revealed that the --storage-opt size= flag, meant to cap a container's writable layer, is silently ignored under the new default backend. While overlay2 correctly refuses to start a container when the required XFS filesystem with pquota is absent, the containerd snapshotter accepts the flag, starts the container, and allows writes far beyond the specified limit with no error or warning. Making matters worse, docker inspect still reports the quota as active, meaning compliance checks and audit tools would falsely indicate the limit is enforced. The issue appears to stem from the containerd image store path lacking the filesystem-support validation that the graphdriver path performs, and the behavior change was introduced without any CLI-level notice to users.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.


Discussion (0)
Log in to join the discussion and vote.
Log in