239f5f6440
Validation caught that Docker 29's default containerd-snapshotter keeps the image store at /var/lib/containerd (on the rootfs), so mounting the data volume at /var/lib/docker only moved named volumes — images (1.2G) stayed on the rootfs, defeating the split. overlay2 stores images+overlay+volumes under data-root = the data volume, which the split and the controller's statfs(/) guard both require. Golden daemon.json now sets features.containerd-snapshotter false + a driver guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>