CFCR should ship with a Kubernetes-validated version of Docker

[tvs]

What happened:

The version of Docker running in a cluster is 17.12.1-ce:

# /var/vcap/packages/docker/bin/docker --version
Docker version 17.12.1-ce, build 7390fc6

What you expected to happen:

I would expect CFCR to ship with one of the officially validated versions of Docker:

From Changelog v1.10:

The validated docker versions are the same as for v1.9: 1.11.2 to 1.13.1 and 17.03.x (ref)

How to reproduce it (as minimally and precisely as possible):

Deploy a cluster with CFCR v0.19, ssh to a worker, and run the command seen above.

Anything else we need to know?:

The Docker versions are the same for Kubernetes 1.11:

The validated docker versions are the same as for v1.10: 1.11.2 to 1.13.1 and 17.03.x (ref)

The reason we noticed this problem is that we're seeing issues where secrets volumes fail to unmount when cleaning up a large number of pods. Once the volumes get locked up failing to unmount, the pods all get stuck in a Terminating state that can't be resolved until someone manually restarts the Docker daemon (at which point they'll clear out unless they hit the same lock problem). This issue indicates that this may well be a problem with the version of Docker we're deploying.

For comparison, GKE is only shipping with Docker v17.03 as well:

Docker upgraded from 1.12 to 17.03 and default storage driver changed to overlay2

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/159256823

The labels on this github issue will be updated when the story is started.

[alex-slynko]

see also kubernetes/kubernetes#53221

[MarkusTeufelberger]

Maybe also kubernetes/kubernetes#65089

[addisonhuddy]

Updated to 18.06