How Linux Uses OverlayFS Union File System

OverlayFS is a modern union mount filesystem implementation built directly into the Linux kernel that combines multiple directories into a single, unified view. This article explores how Linux utilizes OverlayFS to merge read-only base layers with writable layers using Copy-on-Write (CoW) mechanics, and examines its critical applications in container runtimes, live operating system environments, and embedded systems.

The Architecture of OverlayFS

OverlayFS presents multiple directory trees on a Linux system as a single coherent filesystem. It achieves this by stacking directories on top of each other, categorized into four core components:

• Lower Directory (lowerdir): The base layer, which is strictly read-only. Linux allows stacking multiple lower directories sequentially.
• Upper Directory (upperdir): The top layer, which is writable. Any new files or changes made to existing files are stored here.
• Work Directory (workdir): An internal, empty directory on the same filesystem as the upper directory, used by Linux to prepare files atomically before moving them to the upper layer.
• Merged Directory (merged): The unified mount point where the user interacts with the combined view of the upper and lower directories.

File Operations and Copy-on-Write Mechanics

Linux handles file operations across these layers using distinct behaviors depending on the action requested:

• Reading Files: When a process reads a file, OverlayFS looks for it in the upperdir. If the file exists there, that version is read. If it does not exist in the upper layer, OverlayFS looks down through the lowerdir stack.
• Modifying Files (Copy-on-Write): If a user modifies a file that resides only in the lowerdir, OverlayFS automatically copies the entire file up to the upperdir before applying the modifications. The original file in the lower layer remains untouched, while the modified copy in the upper layer supersedes it in the merged view.
• Deleting Files (Whiteouts): Because the lower layers cannot be modified, deleting a lower-layer file from the merged view creates a "whiteout" character device in the upperdir. This whiteout node masks the lower-layer file, preventing it from appearing in the unified mount point.

Primary Use Cases in Linux

Container Runtimes

The most prevalent use of OverlayFS is in container engines such as Docker, Podman, and containerd via the overlay2 storage driver. Container images consist of multiple immutable lower layers sharing common libraries and runtimes. When a container starts, Linux creates a thin, dedicated writable upperdir for that instance. This allows hundreds of containers to share the same underlying base image in memory while isolating runtime writes, drastically reducing disk space and startup latency.

Live Media and Recovery Systems

Linux Live CDs and bootable USB drives use OverlayFS to present a fully operational OS from read-only media. The core operating system resides in a compressed, read-only lower filesystem (like SquashFS), while the upperdir is mounted in volatile RAM via tmpfs. Users can install packages and alter settings during a live session, which are safely discarded upon reboot.

Embedded Linux and IoT

In embedded environments, system stability is critical. Devices frequently mount their core operating system partition as a read-only lower directory to guard against filesystem corruption during sudden power losses. Configuration changes or updates can be tracked in an upper partition, which can be cleanly wiped to perform a factory reset without disturbing the core OS.