How to move the default /var/lib/docker to another directory for Docker on Linux

Introduction

Docker stores all its data—images, containers, volumes, and configurations—under the default directory, /var/lib/docker. While this default setup works for most cases, relocating the data directory can improve your Docker Bench Security score and enhance system organization, especially when /var has limited space or you want tighter control over the directory's access and permissions. In this detailed guide, we’ll walk through the process of moving Docker’s data directory to a new location securely and efficiently.

Step 1: Why Move Docker’s Data Directory?

Before diving into the steps, let’s explore the benefits of moving Docker’s data directory:

1. Security Enhancement:
   Isolating Docker’s data can protect sensitive files from being compromised. A custom directory with strict access controls reduces the risk of unauthorized access.
2. Improved Resource Management:
   By relocating the directory to a dedicated partition, you can prevent Docker from filling up your root filesystem, ensuring system stability.
3. Compliance:
   In some organizations, placing application data on specific partitions or storage locations is a compliance requirement.

Step 2: Preparing for the Move

Stop Docker Service:
Docker must be stopped before moving its data directory.

sudo systemctl stop docker

Make sure that Docker is not running

sudo systemctl status docker

Checking if there are any Docker processes is by using the ps command:

ps faux | grep -i docker

Backup Docker Data:
Before making changes, back up your current data to prevent accidental loss. Use the following command to archive the /var/lib/docker directory:

sudo systemctl stop docker
sudo tar -cvzf docker_backup.tar.gz /var/lib/docker

Check Disk Space on the Target Partition:
Ensure the new location has enough free space to accommodate all Docker data.

df -h

Step 3: Create a New Directory

Adjust ownership and permissions:

sudo chown root:root /mnt/docker-data
sudo chmod 700 /mnt/docker-data

Choose a new location for the Docker data directory, such as /mnt/docker-data.

sudo mkdir -p /mnt/docker-data

Step 4: Move Existing Data

Copy all data from /var/lib/docker to the new directory:

sudo rsync -aP /var/lib/docker/ /mnt/docker-data/

This command ensures that all file attributes are preserved and progress is displayed.

Step 5: Update Docker Configuration

Verify the Configuration:
Test the Docker configuration to ensure there are no syntax errors:

sudo dockerd --validate

Edit the Docker Daemon Configuration File:
Open or create /lib/systemd/system/docker.service if it doesn’t exist:

sudo vim /lib/systemd/system/docker.service

Update the ExecStart command following entry to specify the new data directory:

ExecStart=/usr/bin/dockerd -g /mnt/docker-data -H fd:// --containerd=/run/containerd/containerd.sock

Options #2
In case, for some reason this didn't work, try to add to /etc/docker/daemon.json file following configuration:

{
 "data-root": "/mnt/docker-data"
}

Step 6: Restart Docker and Verify

Reload the systemd daemons:

sudo systemctl daemon-reload

Start Docker service:

systemctl start docker

Test Docker functionality by running a container:

docker run hello-world

Verify the new data directory is being used:

docker info | grep "Docker Root Dir"

Output:

Docker Root Dir: /mnt/docker-data

Restart the Docker service:

sudo systemctl start docker

Step 7: Clean Up Old Data (Optional)

Once everything is working correctly, you can remove the old data directory to free up space:

sudo rm -rf /var/lib/docker

Step 8: Update System Backups

If you use backup tools, ensure the new Docker data directory is included in your backup configurations.

Tips for Enhanced Security

1. Encrypt the New Directory:
   Use disk encryption tools like LUKS to secure the data directory if it contains sensitive information.
2. Restrict Access:
   Set strict permissions to limit access to the directory only to the Docker service.

Mount Options:
Mount the new directory with noexec, nodev, and nosuid options to prevent unauthorized execution of binaries. Update /etc/fstab for persistent mounting:

/dev/sdX1 /mnt/docker-data ext4 defaults,noexec,nodev,nosuid 0 2

Conclusion

Relocating Docker’s data directory is a straightforward yet impactful way to improve Docker Bench Security scores, enhance organization, and maintain system stability. By following this guide, you can ensure your Docker setup is secure, resilient, and compliant with best practices.