Overlay Filesystems and Layered Images

In this lesson, you will learn how Linux uses OverlayFS to construct a single, unified view of a filesystem by stacking read-only layers beneath a writable one, which is the mechanical foundation of modern container images.

The Anatomy of an Overlay

Imagine you have a base directory containing a core operating system and a second directory containing a specific application. Instead of copying all those files into one massive folder, OverlayFS allows you to "mount" these layers on top of each other.

There are three primary components:

1. Lowerdir(s): One or more read-only directories. These hold the base content (like system libraries or binaries).
2. Upperdir: A single writable directory. This is where all changes are stored.
3. Merged: The final directory where the user sees the combined result.

The "Copy-Up" Mechanism

When you modify a file that exists in a lowerdir, the filesystem does not actually change the base layer (because it is read-only). Instead, it performs a Copy-up: it copies the file from the read-only layer into the upperdir and applies the changes there. Any new files created by the user are also placed directly into the upperdir.

This is exactly how containers work. You can have a hundred containers sharing the same read-only base image (the lowerdir), but each container maintains its own private upperdir for its specific runtime data.

Example Setup

You can simulate this mounting process with root privileges using the mount command:

# Create our layer directories
mkdir lower upper work merged

# Mount the overlay
mount -t overlay overlay \
  -o lowerdir=lower,upperdir=upper,workdir=work merged

• workdir is a temporary staging area required by the kernel to prepare files before they are moved to the upperdir.
• If you create a file in merged, it physically appears in upper. If you delete a file that originated in lower, the system creates a "whiteout" file in upper to mask the original from the view of the merged directory.

Because the base layers remain immutable, they can be shared across memory and disk, making container images incredibly efficient to store and distribute.

Key Takeaway: OverlayFS creates a unified filesystem view by using a writable top layer to intercept changes, allowing multiple read-only layers to be shared safely and efficiently.