The default distro is Container Optimised OS: https://cloud.google.com/container-optimized-os/docs/. It's derived from Chromium OS, which means we can take advantage of the team who build images for the many devices which use it, and the security response infrastructure around it.

With 'docker info' on a node you can see we use OverlayFS, which seems a popular choice in the community also: http://burkelibbey.s3.amazonaws.com/dockercon-fs.pdf