Release 1.41.2

March 02, 2026

Support for Docker Version 29

Docker version 29 deprecates the legacy overlay2 storage driver and transitions to the containerd image store, which continues to use overlayfs as its underlying technology.  
Qualys Container Security sensor now supports installation on Docker version 29.

This update,

• Ensures future‑proof compatibility as Docker 29 removes the legacy overlay2 storage driver.
• Improves runtime stability by leveraging the more robust containerd image store.
• Aligns with modern cloud‑native standards used across Kubernetes and OCI ecosystems.
• Reduces technical debt by avoiding reliance on deprecated Docker components.
• Enhances performance through faster, more efficient image handling in containerd.

For Docker 29 and above versions with 'overlayfs' storage driver, Qualys strongly recommends a fresh installation of Qualys Container Security Sensor 1.41.2.

With this release, Qualys Container Security Sensor has introduced a new argument - ContainerdRootDirectory.
Along with this, CS Sensor now supports a new value for the 'StorageDriverType' argument - overlayfs. 

Installation Method	Runtime	Arguments / Volume mount	Description
installSensor.sh	Docker Runtime	StorageDriverType	Specify the storage driver type for the runtime. New value: overlayfs Usage: StorageDriverType=overlayfs
		ContainerdRootDirectory	Specify the containerd runtime's root directory. Usage: ContainerdRootDirectory=/var/lib/containerd /var/lib/containerd is the default location on Docker host for the containerd storage directory. You can change it as per your requirement. To know more, refer to CS Sensor Deployment Help.
'docker run' command	Docker Runtime	--storage-driver-type	Specify the storage driver type for the runtime. New value: overlayfs Usage: --storage-driver-type overlayfs
		-v /var/lib/containerd:/var/lib/containerd:ro	Specify the containerd runtime's root directory. Usage: -v /var/lib/containerd:/var/lib/containerd:ro /var/lib/containerd is the default location on Docker host for the containerd storage directory. You can change it as per your requirement. To know more, refer to CS Sensor Deployment Help.

Installation Commands

The following are the CS Sensor installation commands on the Docker environment.

InstallSensor.sh

Run the following command to install CS Sensor on a Docker environment using InstallSensor.sh
sudo ./installsensor.sh ActivationId=<Activation ID> CustomerId=<Customer ID> Storage=/usr/local/qualys/sensor/data DockerRootDirectory=/var/lib/docker ContainerdRootDirectory=/var/lib/containerd -s --perform-sca-scan

Docker Run

Run the following command to install CS Sensor on a Docker environment using Docker Run.
docker run -d --restart on-failure -v /var/run/docker.sock:/var/run/docker.sock:ro -v /etc/qualys:/usr/local/qualys/qpa/data/conf/agent-data -v /var/lib/containerd:/var/lib/containerd:ro -v /var/lib/docker:/var/lib/docker:ro -v /usr/local/qualys/sensor/data:/usr/local/qualys/qpa/data -e ACTIVATIONID=<Activation ID> -e CUSTOMERID=<Customer ID> -e POD_URL=<POD URL> --net=host --name qualys-container-sensor qualys/qcs-sensor:latest --perform-sca-scan