sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget)/translations/zh_CN/filesystems/overlayfsmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/zh_TW/filesystems/overlayfsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/it_IT/filesystems/overlayfsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/ja_JP/filesystems/overlayfsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/ko_KR/filesystems/overlayfsmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/sp_SP/filesystems/overlayfsmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhC/var/lib/git/docbuild/linux/Documentation/filesystems/overlayfs.rsthKubh paragraph)}(hOWritten by: Neil Brown Please see MAINTAINERS file for where to send questions.h]hOWritten by: Neil Brown Please see MAINTAINERS file for where to send questions.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubhsection)}(hhh](htitle)}(hOverlay Filesystemh]hOverlay Filesystem}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(hXThis document describes a prototype for a new approach to providing overlay-filesystem functionality in Linux (sometimes referred to as union-filesystems). An overlay-filesystem tries to present a filesystem which is the result over overlaying one filesystem on top of the other.h]hXThis document describes a prototype for a new approach to providing overlay-filesystem functionality in Linux (sometimes referred to as union-filesystems). An overlay-filesystem tries to present a filesystem which is the result over overlaying one filesystem on top of the other.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(hOverlay objectsh]hOverlay objects}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(hXbThe overlay filesystem approach is 'hybrid', because the objects that appear in the filesystem do not always appear to belong to that filesystem. In many cases, an object accessed in the union will be indistinguishable from accessing the corresponding object from the original filesystem. This is most obvious from the 'st_dev' field returned by stat(2).h]hXjThe overlay filesystem approach is ‘hybrid’, because the objects that appear in the filesystem do not always appear to belong to that filesystem. In many cases, an object accessed in the union will be indistinguishable from accessing the corresponding object from the original filesystem. This is most obvious from the ‘st_dev’ field returned by stat(2).}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hXWhile directories will report an st_dev from the overlay-filesystem, non-directory objects may report an st_dev from the lower filesystem or upper filesystem that is providing the object. Similarly st_ino will only be unique when combined with st_dev, and both of these can change over the lifetime of a non-directory object. Many applications and tools ignore these values and will not be affected.h]hXWhile directories will report an st_dev from the overlay-filesystem, non-directory objects may report an st_dev from the lower filesystem or upper filesystem that is providing the object. Similarly st_ino will only be unique when combined with st_dev, and both of these can change over the lifetime of a non-directory object. Many applications and tools ignore these values and will not be affected.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hXfIn the special case of all overlay layers on the same underlying filesystem, all objects will report an st_dev from the overlay filesystem and st_ino from the underlying filesystem. This will make the overlay mount more compliant with filesystem scanners and overlay objects will be distinguishable from the corresponding objects in the original filesystem.h]hXfIn the special case of all overlay layers on the same underlying filesystem, all objects will report an st_dev from the overlay filesystem and st_ino from the underlying filesystem. This will make the overlay mount more compliant with filesystem scanners and overlay objects will be distinguishable from the corresponding objects in the original filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hX/On 64bit systems, even if all overlay layers are not on the same underlying filesystem, the same compliant behavior could be achieved with the "xino" feature. The "xino" feature composes a unique object identifier from the real object st_ino and an underlying fsid number. The "xino" feature uses the high inode number bits for fsid, because the underlying filesystems rarely use the high inode number bits. In case the underlying inode number does overflow into the high xino bits, overlay filesystem will fall back to the non xino behavior for that inode.h]hX;On 64bit systems, even if all overlay layers are not on the same underlying filesystem, the same compliant behavior could be achieved with the “xino” feature. The “xino” feature composes a unique object identifier from the real object st_ino and an underlying fsid number. The “xino” feature uses the high inode number bits for fsid, because the underlying filesystems rarely use the high inode number bits. In case the underlying inode number does overflow into the high xino bits, overlay filesystem will fall back to the non xino behavior for that inode.}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hhhhubh)}(hX{The "xino" feature can be enabled with the "-o xino=on" overlay mount option. If all underlying filesystems support NFS file handles, the value of st_ino for overlay filesystem objects is not only unique, but also persistent over the lifetime of the filesystem. The "-o xino=auto" overlay mount option enables the "xino" feature only if the persistent st_ino requirement is met.h]hXThe “xino” feature can be enabled with the “-o xino=on” overlay mount option. If all underlying filesystems support NFS file handles, the value of st_ino for overlay filesystem objects is not only unique, but also persistent over the lifetime of the filesystem. The “-o xino=auto” overlay mount option enables the “xino” feature only if the persistent st_ino requirement is met.}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK0hhhhubh)}(hXThe following table summarizes what can be expected in different overlay configurations.h]hXThe following table summarizes what can be expected in different overlay configurations.}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK6hhhhubh)}(hhh](h)}(hInode propertiesh]hInode properties}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjLhhhhhK:ubhtable)}(hhh]htgroup)}(hhh](hcolspec)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubjh)}(hhh]h}(h]h ]h"]h$]h&]colwidthKuh1jghjdubhthead)}(hhh]hrow)}(hhh](hentry)}(hhh]h)}(h Configurationh]h Configuration}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hPersistent st_inoh]hPersistent st_ino}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hjubah}(h]h ]h"]h$]h&]morecolsKuh1jhjubj)}(hhh]h)}(hUniform st_devh]hUniform st_dev}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hjubah}(h]h ]h"]h$]h&]morecolsKuh1jhjubj)}(hhh]h)}(hst_ino == d_inoh]hst_ino == d_ino}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hjubah}(h]h ]h"]h$]h&]morecolsKuh1jhjubj)}(hhh]h)}(hd_ino == i_ino [*]h]hd_ino == i_ino [*]}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hj.ubah}(h]h ]h"]h$]h&]morecolsKuh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1jhjdubhtbody)}(hhh](j)}(hhh](j)}(hhh]h}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(hdirh]hdir}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjdubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(h!dirh]h!dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hj|ubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(hdirh]hdir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(h!dirh]h!dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(hdirh]hdir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(h!dirh]h!dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(hdirh]hdir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubj)}(hhh]h)}(h!dirh]h!dir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK@hj ubah}(h]h ]h"]h$]h&]morerowsKuh1jhjWubeh}(h]h ]h"]h$]h&]uh1jhjTubj)}(hhh]h}(h]h ]h"]h$]h&]uh1jhjTubj)}(hhh](j)}(hhh]h)}(hAll layers on same fsh]hAll layers on same fs}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhj6ubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hYh]hY}(hjPhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjMubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjdubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjzubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjubah}(h]h ]h"]h$]h&]uh1jhj3ubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKBhjubah}(h]h ]h"]h$]h&]uh1jhj3ubeh}(h]h ]h"]h$]h&]uh1jhjTubj)}(hhh](j)}(hhh]h)}(hLayers not on same fs, xino=offh]hLayers not on same fs, xino=off}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hNh]hN}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhj5ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjKubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjaubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjwubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKEhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjTubj)}(hhh](j)}(hhh]h)}(h xino=on/autoh]h xino=on/auto}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhj1ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjGubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhj]ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjsubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKIhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjTubj)}(hhh](j)}(hhh]h)}(hxino=on/auto, ino overflowh]hxino=on/auto, ino overflow}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhj-ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hj#h]hN}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjCubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hhh]h)}(hjRh]hY}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKKhjYubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhjTubeh}(h]h ]h"]h$]h&]uh1jRhjdubeh}(h]h ]h"]h$]h&]colsK uh1jbhj_ubah}(h]h ]h"]h$]h&]uh1j]hjLhhhhhNubh)}(h[*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several /proc files, such as /proc/locks and /proc/self/fdinfo/ of an inotify file descriptor.h]h[*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several /proc files, such as /proc/locks and /proc/self/fdinfo/ of an inotify file descriptor.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKOhjLhhubeh}(h]inode-propertiesah ]h"]inode propertiesah$]h&]uh1hhhhhhhhK: referencedKubeh}(h]overlay-objectsah ]h"]overlay objectsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hUpper and Lowerh]hUpper and Lower}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKTubh)}(hX5An overlay filesystem combines two filesystems - an 'upper' filesystem and a 'lower' filesystem. When a name exists in both filesystems, the object in the 'upper' filesystem is visible while the object in the 'lower' filesystem is either hidden or, in the case of directories, merged with the 'upper' object.h]hXIAn overlay filesystem combines two filesystems - an ‘upper’ filesystem and a ‘lower’ filesystem. When a name exists in both filesystems, the object in the ‘upper’ filesystem is visible while the object in the ‘lower’ filesystem is either hidden or, in the case of directories, merged with the ‘upper’ object.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKVhjhhubh)}(hX It would be more correct to refer to an upper and lower 'directory tree' rather than 'filesystem' as it is quite possible for both directory trees to be in the same filesystem and there is no requirement that the root of a filesystem be given for either upper or lower.h]hXIt would be more correct to refer to an upper and lower ‘directory tree’ rather than ‘filesystem’ as it is quite possible for both directory trees to be in the same filesystem and there is no requirement that the root of a filesystem be given for either upper or lower.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK\hjhhubh)}(hXA wide range of filesystems supported by Linux can be the lower filesystem, but not all filesystems that are mountable by Linux have the features needed for OverlayFS to work. The lower filesystem does not need to be writable. The lower filesystem can even be another overlayfs. The upper filesystem will normally be writable and if it is it must support the creation of trusted.* and/or user.* extended attributes, and must provide valid d_type in readdir responses, so NFS is not suitable.h]hXA wide range of filesystems supported by Linux can be the lower filesystem, but not all filesystems that are mountable by Linux have the features needed for OverlayFS to work. The lower filesystem does not need to be writable. The lower filesystem can even be another overlayfs. The upper filesystem will normally be writable and if it is it must support the creation of trusted.* and/or user.* extended attributes, and must provide valid d_type in readdir responses, so NFS is not suitable.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKbhjhhubh)}(hMA read-only overlay of two read-only filesystems may use any filesystem type.h]hMA read-only overlay of two read-only filesystems may use any filesystem type.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKjhjhhubeh}(h]upper-and-lowerah ]h"]upper and lowerah$]h&]uh1hhhhhhhhKTubh)}(hhh](h)}(h Directoriesh]h Directories}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKnubh)}(hOverlaying mainly involves directories. If a given name appears in both upper and lower filesystems and refers to a non-directory in either, then the lower object is hidden - the name refers only to the upper object.h]hOverlaying mainly involves directories. If a given name appears in both upper and lower filesystems and refers to a non-directory in either, then the lower object is hidden - the name refers only to the upper object.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKphjhhubh)}(hQWhere both upper and lower objects are directories, a merged directory is formed.h]hQWhere both upper and lower objects are directories, a merged directory is formed.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKuhjhhubh)}(hzAt mount time, the two directories given as mount options "lowerdir" and "upperdir" are combined into a merged directory::h]hAt mount time, the two directories given as mount options “lowerdir” and “upperdir” are combined into a merged directory:}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKxhjhhubh literal_block)}(hRmount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\ workdir=/work /mergedh]hRmount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\ workdir=/work /merged}hj5sbah}(h]h ]h"]h$]h&]hhuh1j3hhhK{hjhhubh)}(hPThe "workdir" needs to be an empty directory on the same filesystem as upperdir.h]hTThe “workdir” needs to be an empty directory on the same filesystem as upperdir.}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK~hjhhubh)}(hXhThen whenever a lookup is requested in such a merged directory, the lookup is performed in each actual directory and the combined result is cached in the dentry belonging to the overlay filesystem. If both actual lookups find directories, both are stored and a merged directory is created, otherwise only one is stored: the upper if it exists, else the lower.h]hXhThen whenever a lookup is requested in such a merged directory, the lookup is performed in each actual directory and the combined result is cached in the dentry belonging to the overlay filesystem. If both actual lookups find directories, both are stored and a merged directory is created, otherwise only one is stored: the upper if it exists, else the lower.}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hOnly the lists of names from directories are merged. Other content such as metadata and extended attributes are reported for the upper directory only. These attributes of the lower directory are hidden.h]hOnly the lists of names from directories are merged. Other content such as metadata and extended attributes are reported for the upper directory only. These attributes of the lower directory are hidden.}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h] directoriesah ]h"] directoriesah$]h&]uh1hhhhhhhhKnubh)}(hhh](h)}(h whiteouts and opaque directoriesh]h whiteouts and opaque directories}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjuhhhhhKubh)}(hIn order to support rm and rmdir without changing the lower filesystem, an overlay filesystem needs to record in the upper filesystem that files have been removed. This is done using whiteouts and opaque directories (non-directories are always opaque).h]hIn order to support rm and rmdir without changing the lower filesystem, an overlay filesystem needs to record in the upper filesystem that files have been removed. This is done using whiteouts and opaque directories (non-directories are always opaque).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuhhubh)}(hA whiteout is created as a character device with 0/0 device number or as a zero-size regular file with the xattr "trusted.overlay.whiteout".h]hA whiteout is created as a character device with 0/0 device number or as a zero-size regular file with the xattr “trusted.overlay.whiteout”.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuhhubh)}(hWhen a whiteout is found in the upper level of a merged directory, any matching name in the lower level is ignored, and the whiteout itself is also hidden.h]hWhen a whiteout is found in the upper level of a merged directory, any matching name in the lower level is ignored, and the whiteout itself is also hidden.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuhhubh)}(hA directory is made opaque by setting the xattr "trusted.overlay.opaque" to "y". Where the upper filesystem contains an opaque directory, any directory in the lower filesystem with the same name is ignored.h]hA directory is made opaque by setting the xattr “trusted.overlay.opaque” to “y”. Where the upper filesystem contains an opaque directory, any directory in the lower filesystem with the same name is ignored.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuhhubh)}(hXAn opaque directory should not contain any whiteouts, because they do not serve any purpose. A merge directory containing regular files with the xattr "trusted.overlay.whiteout", should be additionally marked by setting the xattr "trusted.overlay.opaque" to "x" on the merge directory itself. This is needed to avoid the overhead of checking the "trusted.overlay.whiteout" on all entries during readdir in the common case.h]hXAn opaque directory should not contain any whiteouts, because they do not serve any purpose. A merge directory containing regular files with the xattr “trusted.overlay.whiteout”, should be additionally marked by setting the xattr “trusted.overlay.opaque” to “x” on the merge directory itself. This is needed to avoid the overhead of checking the “trusted.overlay.whiteout” on all entries during readdir in the common case.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjuhhubeh}(h] whiteouts-and-opaque-directoriesah ]h"] whiteouts and opaque directoriesah$]h&]uh1hhhhhhhhKjKubh)}(hhh](h)}(hreaddirh]hreaddir}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hX3When a 'readdir' request is made on a merged directory, the upper and lower directories are each read and the name lists merged in the obvious way (upper is read first, then lower - entries that already exist are not re-added). This merged name list is cached in the 'struct file' and so remains as long as the file is kept open. If the directory is opened and read by two processes at the same time, they will each have separate caches. A seekdir to the start of the directory (offset 0) followed by a readdir will cause the cache to be discarded and rebuilt.h]hX;When a ‘readdir’ request is made on a merged directory, the upper and lower directories are each read and the name lists merged in the obvious way (upper is read first, then lower - entries that already exist are not re-added). This merged name list is cached in the ‘struct file’ and so remains as long as the file is kept open. If the directory is opened and read by two processes at the same time, they will each have separate caches. A seekdir to the start of the directory (offset 0) followed by a readdir will cause the cache to be discarded and rebuilt.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hThis means that changes to the merged directory do not appear while a directory is being read. This is unlikely to be noticed by many programs.h]hThis means that changes to the merged directory do not appear while a directory is being read. This is unlikely to be noticed by many programs.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hNseek offsets are assigned sequentially when the directories are read. Thus if:h]hNseek offsets are assigned sequentially when the directories are read. Thus if:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh block_quote)}(h- read part of a directory - remember an offset, and close the directory - re-open the directory some time later - seek to the remembered offset h]h bullet_list)}(hhh](h list_item)}(hread part of a directoryh]h)}(hjh]hread part of a directory}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h+remember an offset, and close the directoryh]h)}(hj5h]h+remember an offset, and close the directory}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj3ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h%re-open the directory some time laterh]h)}(hjLh]h%re-open the directory some time later}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjJubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hseek to the remembered offset h]h)}(hseek to the remembered offseth]hseek to the remembered offset}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjaubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhKhjubah}(h]h ]h"]h$]h&]uh1jhhhKhjhhubh)}(hthere may be little correlation between the old and new locations in the list of filenames, particularly if anything has changed in the directory.h]hthere may be little correlation between the old and new locations in the list of filenames, particularly if anything has changed in the directory.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hjReaddir on directories that are not merged is simply handled by the underlying directory (upper or lower).h]hjReaddir on directories that are not merged is simply handled by the underlying directory (upper or lower).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]readdirah ]h"]readdirah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hrenaming directoriesh]hrenaming directories}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hWhen renaming a directory that is on the lower layer or merged (i.e. the directory was not created on the upper layer to start with) overlayfs can handle it in two different ways:h]hWhen renaming a directory that is on the lower layer or merged (i.e. the directory was not created on the upper layer to start with) overlayfs can handle it in two different ways:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubhenumerated_list)}(hhh](j)}(hXreturn EXDEV error: this error is returned by rename(2) when trying to move a file or directory across filesystem boundaries. Hence applications are usually prepared to handle this error (mv(1) for example recursively copies the directory tree). This is the default behavior. h]h)}(hXreturn EXDEV error: this error is returned by rename(2) when trying to move a file or directory across filesystem boundaries. Hence applications are usually prepared to handle this error (mv(1) for example recursively copies the directory tree). This is the default behavior.h]hXreturn EXDEV error: this error is returned by rename(2) when trying to move a file or directory across filesystem boundaries. Hence applications are usually prepared to handle this error (mv(1) for example recursively copies the directory tree). This is the default behavior.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hXIf the "redirect_dir" feature is enabled, then the directory will be copied up (but not the contents). Then the "trusted.overlay.redirect" extended attribute is set to the path of the original location from the root of the overlay. Finally the directory is moved to the new location. h]h)}(hXIf the "redirect_dir" feature is enabled, then the directory will be copied up (but not the contents). Then the "trusted.overlay.redirect" extended attribute is set to the path of the original location from the root of the overlay. Finally the directory is moved to the new location.h]hX%If the “redirect_dir” feature is enabled, then the directory will be copied up (but not the contents). Then the “trusted.overlay.redirect” extended attribute is set to the path of the original location from the root of the overlay. Finally the directory is moved to the new location.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]enumtypearabicprefixhsuffix.uh1jhjhhhhhKubh)}(h:There are several ways to tune the "redirect_dir" feature.h]h>There are several ways to tune the “redirect_dir” feature.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hKernel config options:h]hKernel config options:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hhh](j)}(hZOVERLAY_FS_REDIRECT_DIR: If this is enabled, then redirect_dir is turned on by default.h]hdefinition_list)}(hhh]hdefinition_list_item)}(hXOVERLAY_FS_REDIRECT_DIR: If this is enabled, then redirect_dir is turned on by default.h](hterm)}(hOVERLAY_FS_REDIRECT_DIR:h]hOVERLAY_FS_REDIRECT_DIR:}(hj: hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj4 ubh definition)}(hhh]h)}(h?If this is enabled, then redirect_dir is turned on by default.h]h?If this is enabled, then redirect_dir is turned on by default.}(hjM hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjJ ubah}(h]h ]h"]h$]h&]uh1jH hj4 ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj/ ubah}(h]h ]h"]h$]h&]uh1j- hj) ubah}(h]h ]h"]h$]h&]uh1jhj& hhhNhNubj)}(hX@OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW: If this is enabled, then redirects are always followed by default. Enabling this results in a less secure configuration. Enable this option only when worried about backward compatibility with kernels that have the redirect_dir feature and follow redirects even if turned off. h]j. )}(hhh]j3 )}(hX8OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW: If this is enabled, then redirects are always followed by default. Enabling this results in a less secure configuration. Enable this option only when worried about backward compatibility with kernels that have the redirect_dir feature and follow redirects even if turned off. h](j9 )}(h"OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:h]h"OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:}(hj~ hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhjz ubjI )}(hhh]h)}(hXIf this is enabled, then redirects are always followed by default. Enabling this results in a less secure configuration. Enable this option only when worried about backward compatibility with kernels that have the redirect_dir feature and follow redirects even if turned off.h]hXIf this is enabled, then redirects are always followed by default. Enabling this results in a less secure configuration. Enable this option only when worried about backward compatibility with kernels that have the redirect_dir feature and follow redirects even if turned off.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jH hjz ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhjw ubah}(h]h ]h"]h$]h&]uh1j- hjs ubah}(h]h ]h"]h$]h&]uh1jhj& hhhNhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hMModule options (can also be changed through /sys/module/overlay/parameters/):h]hMModule options (can also be changed through /sys/module/overlay/parameters/):}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hhh](j)}(hN"redirect_dir=BOOL": See OVERLAY_FS_REDIRECT_DIR kernel config option above.h]j. )}(hhh]j3 )}(hL"redirect_dir=BOOL": See OVERLAY_FS_REDIRECT_DIR kernel config option above.h](j9 )}(h"redirect_dir=BOOL":h]h“redirect_dir=BOOL”:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj ubjI )}(hhh]h)}(h7See OVERLAY_FS_REDIRECT_DIR kernel config option above.h]h7See OVERLAY_FS_REDIRECT_DIR kernel config option above.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj ubah}(h]h ]h"]h$]h&]uh1j- hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubj)}(hb"redirect_always_follow=BOOL": See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.h]j. )}(hhh]j3 )}(h`"redirect_always_follow=BOOL": See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.h](j9 )}(h"redirect_always_follow=BOOL":h]h"“redirect_always_follow=BOOL”:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj ubjI )}(hhh]h)}(hASee OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.h]hASee OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.}(hj* hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj' ubah}(h]h ]h"]h$]h&]uh1jH hj ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj ubah}(h]h ]h"]h$]h&]uh1j- hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubj)}(h\"redirect_max=NUM": The maximum number of bytes in an absolute redirect (default is 256). h]j. )}(hhh]j3 )}(hZ"redirect_max=NUM": The maximum number of bytes in an absolute redirect (default is 256). h](j9 )}(h"redirect_max=NUM":h]h“redirect_max=NUM”:}(hj[ hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhjW ubjI )}(hhh]h)}(hEThe maximum number of bytes in an absolute redirect (default is 256).h]hEThe maximum number of bytes in an absolute redirect (default is 256).}(hjl hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhji ubah}(h]h ]h"]h$]h&]uh1jH hjW ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhjT ubah}(h]h ]h"]h$]h&]uh1j- hjP ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hMount options:h]hMount options:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hhh](j)}(h+"redirect_dir=on": Redirects are enabled.h]j. )}(hhh]j3 )}(h)"redirect_dir=on": Redirects are enabled.h](j9 )}(h"redirect_dir=on":h]h“redirect_dir=on”:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj ubjI )}(hhh]h)}(hRedirects are enabled.h]hRedirects are enabled.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj ubah}(h]h ]h"]h$]h&]uh1j- hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubj)}(hA"redirect_dir=follow": Redirects are not created, but followed.h]j. )}(hhh]j3 )}(h?"redirect_dir=follow": Redirects are not created, but followed.h](j9 )}(h"redirect_dir=follow":h]h“redirect_dir=follow”:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj ubjI )}(hhh]h)}(h(Redirects are not created, but followed.h]h(Redirects are not created, but followed.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj ubah}(h]h ]h"]h$]h&]uh1j- hj ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubj)}(hF"redirect_dir=nofollow": Redirects are not created and not followed.h]j. )}(hhh]j3 )}(hD"redirect_dir=nofollow": Redirects are not created and not followed.h](j9 )}(h"redirect_dir=nofollow":h]h“redirect_dir=nofollow”:}(hj8 hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhj4 ubjI )}(hhh]h)}(h+Redirects are not created and not followed.h]h+Redirects are not created and not followed.}(hjI hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjF ubah}(h]h ]h"]h$]h&]uh1jH hj4 ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhj1 ubah}(h]h ]h"]h$]h&]uh1j- hj- ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubj)}(h"redirect_dir=off": If "redirect_always_follow" is enabled in the kernel/module config, this "off" translates to "follow", otherwise it translates to "nofollow". h]j. )}(hhh]j3 )}(h"redirect_dir=off": If "redirect_always_follow" is enabled in the kernel/module config, this "off" translates to "follow", otherwise it translates to "nofollow". h](j9 )}(h"redirect_dir=off":h]h“redirect_dir=off”:}(hjz hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhKhjv ubjI )}(hhh]h)}(hIf "redirect_always_follow" is enabled in the kernel/module config, this "off" translates to "follow", otherwise it translates to "nofollow".h]hIf “redirect_always_follow” is enabled in the kernel/module config, this “off” translates to “follow”, otherwise it translates to “nofollow”.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj ubah}(h]h ]h"]h$]h&]uh1jH hjv ubeh}(h]h ]h"]h$]h&]uh1j2 hhhKhjs ubah}(h]h ]h"]h$]h&]uh1j- hjo ubah}(h]h ]h"]h$]h&]uh1jhj hhhNhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hX When the NFS export feature is enabled, every copied up directory is indexed by the file handle of the lower inode and a file handle of the upper directory is stored in a "trusted.overlay.upper" extended attribute on the index entry. On lookup of a merged directory, if the upper directory does not match the file handle stores in the index, that is an indication that multiple upper directories may be redirected to the same lower directory. In that case, lookup returns an error and warns about a possible inconsistency.h]hXWhen the NFS export feature is enabled, every copied up directory is indexed by the file handle of the lower inode and a file handle of the upper directory is stored in a “trusted.overlay.upper” extended attribute on the index entry. On lookup of a merged directory, if the upper directory does not match the file handle stores in the index, that is an indication that multiple upper directories may be redirected to the same lower directory. In that case, lookup returns an error and warns about a possible inconsistency.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hBecause lower layer redirects cannot be verified with the index, enabling NFS export support on an overlay filesystem with no upper layer requires turning off redirect follow (e.g. "redirect_dir=nofollow").h]hBecause lower layer redirects cannot be verified with the index, enabling NFS export support on an overlay filesystem with no upper layer requires turning off redirect follow (e.g. “redirect_dir=nofollow”).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]renaming-directoriesah ]h"]renaming directoriesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hNon-directoriesh]hNon-directories}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubh)}(hXObjects that are not directories (files, symlinks, device-special files etc.) are presented either from the upper or lower filesystem as appropriate. When a file in the lower filesystem is accessed in a way that requires write-access, such as opening for write access, changing some metadata etc., the file is first copied from the lower filesystem to the upper filesystem (copy_up). Note that creating a hard-link also requires copy_up, though of course creation of a symlink does not.h]hXObjects that are not directories (files, symlinks, device-special files etc.) are presented either from the upper or lower filesystem as appropriate. When a file in the lower filesystem is accessed in a way that requires write-access, such as opening for write access, changing some metadata etc., the file is first copied from the lower filesystem to the upper filesystem (copy_up). Note that creating a hard-link also requires copy_up, though of course creation of a symlink does not.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hj hhubh)}(hzThe copy_up may turn out to be unnecessary, for example if the file is opened for read-write but the data is not modified.h]hzThe copy_up may turn out to be unnecessary, for example if the file is opened for read-write but the data is not modified.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hXwThe copy_up process first makes sure that the containing directory exists in the upper filesystem - creating it and any parents as necessary. It then creates the object with the same metadata (owner, mode, mtime, symlink-target etc.) and then if the object is a file, the data is copied from the lower to the upper filesystem. Finally any extended attributes are copied up.h]hXwThe copy_up process first makes sure that the containing directory exists in the upper filesystem - creating it and any parents as necessary. It then creates the object with the same metadata (owner, mode, mtime, symlink-target etc.) and then if the object is a file, the data is copied from the lower to the upper filesystem. Finally any extended attributes are copied up.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hX?Once the copy_up is complete, the overlay filesystem simply provides direct access to the newly created file in the upper filesystem - future operations on the file are barely noticed by the overlay filesystem (though an operation on the name of the file such as rename or unlink will of course be noticed and handled).h]hX?Once the copy_up is complete, the overlay filesystem simply provides direct access to the newly created file in the upper filesystem - future operations on the file are barely noticed by the overlay filesystem (though an operation on the name of the file such as rename or unlink will of course be noticed and handled).}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubeh}(h]non-directoriesah ]h"]non-directoriesah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hPermission modelh]hPermission model}(hj/ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj, hhhhhM%ubh)}(hfAn overlay filesystem stashes credentials that will be used when accessing lower or upper filesystems.h]hfAn overlay filesystem stashes credentials that will be used when accessing lower or upper filesystems.}(hj= hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM'hj, hhubh)}(hIn the old mount api the credentials of the task calling mount(2) are stashed. In the new mount api the credentials of the task creating the superblock through FSCONFIG_CMD_CREATE command of fsconfig(2) are stashed.h]hIn the old mount api the credentials of the task calling mount(2) are stashed. In the new mount api the credentials of the task creating the superblock through FSCONFIG_CMD_CREATE command of fsconfig(2) are stashed.}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM*hj, hhubh)}(hXJStarting with kernel v6.15 it is possible to use the "override_creds" mount option which will cause the credentials of the calling task to be recorded. Note that "override_creds" is only meaningful when used with the new mount api as the old mount api combines setting options and superblock creation in a single mount(2) syscall.h]hXRStarting with kernel v6.15 it is possible to use the “override_creds” mount option which will cause the credentials of the calling task to be recorded. Note that “override_creds” is only meaningful when used with the new mount api as the old mount api combines setting options and superblock creation in a single mount(2) syscall.}(hjY hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM/hj, hhubh)}(hGPermission checking in the overlay filesystem follows these principles:h]hGPermission checking in the overlay filesystem follows these principles:}(hjg hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM5hj, hhubj)}(hX1) permission check SHOULD return the same result before and after copy up 2) task creating the overlay mount MUST NOT gain additional privileges 3) task[*] MAY gain additional privileges through the overlay, compared to direct access on underlying lower or upper filesystems h]j)}(hhh](j)}(hHpermission check SHOULD return the same result before and after copy up h]h)}(hGpermission check SHOULD return the same result before and after copy uph]hGpermission check SHOULD return the same result before and after copy up}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM7hj| ubah}(h]h ]h"]h$]h&]uh1jhjy ubj)}(hDtask creating the overlay mount MUST NOT gain additional privileges h]h)}(hCtask creating the overlay mount MUST NOT gain additional privilegesh]hCtask creating the overlay mount MUST NOT gain additional privileges}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM9hj ubah}(h]h ]h"]h$]h&]uh1jhjy ubj)}(htask[*] MAY gain additional privileges through the overlay, compared to direct access on underlying lower or upper filesystems h]h)}(h~task[*] MAY gain additional privileges through the overlay, compared to direct access on underlying lower or upper filesystemsh]h~task[*] MAY gain additional privileges through the overlay, compared to direct access on underlying lower or upper filesystems}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM;hj ubah}(h]h ]h"]h$]h&]uh1jhjy ubeh}(h]h ]h"]h$]h&]j j j hj )uh1jhju ubah}(h]h ]h"]h$]h&]uh1jhhhM7hj, hhubh)}(hDThis is achieved by performing two permission checks on each access:h]hDThis is achieved by performing two permission checks on each access:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM>hj, hhubj)}(hX!a) check if current task is allowed access based on local DAC (owner, group, mode and posix acl), as well as MAC checks b) check if stashed credentials would be allowed real operation on lower or upper layer based on underlying filesystem permissions, again including MAC checks h]j)}(hhh](j)}(hucheck if current task is allowed access based on local DAC (owner, group, mode and posix acl), as well as MAC checks h]h)}(htcheck if current task is allowed access based on local DAC (owner, group, mode and posix acl), as well as MAC checksh]htcheck if current task is allowed access based on local DAC (owner, group, mode and posix acl), as well as MAC checks}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM@hj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hcheck if stashed credentials would be allowed real operation on lower or upper layer based on underlying filesystem permissions, again including MAC checks h]h)}(hcheck if stashed credentials would be allowed real operation on lower or upper layer based on underlying filesystem permissions, again including MAC checksh]hcheck if stashed credentials would be allowed real operation on lower or upper layer based on underlying filesystem permissions, again including MAC checks}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMChj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]j loweralphaj hj j uh1jhj ubah}(h]h ]h"]h$]h&]uh1jhhhM@hj, hhubh)}(hCheck (a) ensures consistency (1) since owner, group, mode and posix acls are copied up. On the other hand it can result in server enforced permissions (used by NFS, for example) being ignored (3).h]hCheck (a) ensures consistency (1) since owner, group, mode and posix acls are copied up. On the other hand it can result in server enforced permissions (used by NFS, for example) being ignored (3).}(hj# hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMGhj, hhubh)}(hX=Check (b) ensures that no task gains permissions to underlying layers that the stashed credentials do not have (2). This also means that it is possible to create setups where the consistency rule (1) does not hold; normally, however, the stashed credentials will have sufficient privileges to perform all operations.h]hX=Check (b) ensures that no task gains permissions to underlying layers that the stashed credentials do not have (2). This also means that it is possible to create setups where the consistency rule (1) does not hold; normally, however, the stashed credentials will have sufficient privileges to perform all operations.}(hj1 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMKhj, hhubh)}(hDAnother way to demonstrate this model is drawing parallels between::h]hCAnother way to demonstrate this model is drawing parallels between:}(hj? hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMQhj, hhubj4)}(hFmount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /mergedh]hFmount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged}hjM sbah}(h]h ]h"]h$]h&]hhuh1j3hhhMShj, hhubh)}(hand::h]hand:}(hj[ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMUhj, hhubj4)}(h/cp -a /lower /upper mount --bind /upper /mergedh]h/cp -a /lower /upper mount --bind /upper /merged}hji sbah}(h]h ]h"]h$]h&]hhuh1j3hhhMWhj, hhubh)}(huThe resulting access permissions should be the same. The difference is in the time of copy (on-demand vs. up-front).h]huThe resulting access permissions should be the same. The difference is in the time of copy (on-demand vs. up-front).}(hjw hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMZhj, hhubeh}(h]permission-modelah ]h"]permission modelah$]h&]uh1hhhhhhhhM%ubh)}(hhh](h)}(hMultiple lower layersh]hMultiple lower layers}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhM_ubh)}(hMultiple lower layers can now be given using the colon (":") as a separator character between the directory names. For example::h]hMultiple lower layers can now be given using the colon (“:”) as a separator character between the directory names. For example:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMahj hhubj4)}(hCmount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /mergedh]hCmount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged}hj sbah}(h]h ]h"]h$]h&]hhuh1j3hhhMdhj hhubh)}(hmAs the example shows, "upperdir=" and "workdir=" may be omitted. In that case the overlay will be read-only.h]huAs the example shows, “upperdir=” and “workdir=” may be omitted. In that case the overlay will be read-only.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMfhj hhubh)}(hThe specified lower directories will be stacked beginning from the rightmost one and going left. In the above example lower1 will be the top, lower2 the middle and lower3 the bottom layer.h]hThe specified lower directories will be stacked beginning from the rightmost one and going left. In the above example lower1 will be the top, lower2 the middle and lower3 the bottom layer.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMihj hhubh)}(hNote: directory names containing colons can be provided as lower layer by escaping the colons with a single backslash. For example::h]hNote: directory names containing colons can be provided as lower layer by escaping the colons with a single backslash. For example:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMmhj hhubj4)}(h`.h](hX;When a layer containing verity xattrs is used, it means that any such metacopy file in the upper layer is guaranteed to match the content that was in the lower at the time of the copy-up. If at any time (during a mount, after a remount, etc) such a file in the lower is replaced or modified in any way, access to the corresponding file in overlayfs will result in EIO errors (either on open, due to overlayfs digest check, or from a later read due to fs-verity) and a detailed error is printed to the kernel logs. For more details of how fs-verity file access works, see }(hjhhhNhNubh)}(hF:ref:`Documentation/filesystems/fsverity.rst `h]hinline)}(hjh]h&Documentation/filesystems/fsverity.rst}(hjhhhNhNubah}(h]h ](xrefstdstd-refeh"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]refdocfilesystems/overlayfs refdomainjreftyperef refexplicitrefwarn reftargetaccessing_verity_filesuh1hhhhMhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hX0Verity can be used as a general robustness check to detect accidental changes in the overlayfs directories in use. But, with additional care it can also give more powerful guarantees. For example, if the upper layer is fully trusted (by using dm-verity or something similar), then an untrusted lower layer can be used to supply validated file content for all metacopy files. If additionally the untrusted lower directories are specified as "Data-only", then they can only supply such file content, and the entire mount can be trusted to match the upper layer.h]hX4Verity can be used as a general robustness check to detect accidental changes in the overlayfs directories in use. But, with additional care it can also give more powerful guarantees. For example, if the upper layer is fully trusted (by using dm-verity or something similar), then an untrusted lower layer can be used to supply validated file content for all metacopy files. If additionally the untrusted lower directories are specified as “Data-only”, then they can only supply such file content, and the entire mount can be trusted to match the upper layer.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hUThis feature is controlled by the "verity" mount option, which supports these values:h]hYThis feature is controlled by the “verity” mount option, which supports these values:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj)}(hhh](j)}(hq"off": The metacopy digest is never generated or used. This is the default if verity option is not specified.h]j. )}(hhh]j3 )}(hm"off": The metacopy digest is never generated or used. This is the default if verity option is not specified.h](j9 )}(h"off":h]h “off”:}(hj8hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhj4ubjI )}(hhh]h)}(hfThe metacopy digest is never generated or used. This is the default if verity option is not specified.h]hfThe metacopy digest is never generated or used. This is the default if verity option is not specified.}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjFubah}(h]h ]h"]h$]h&]uh1jH hj4ubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhj1ubah}(h]h ]h"]h$]h&]uh1j- hj-ubah}(h]h ]h"]h$]h&]uh1jhj*hhhNhNubj)}(h"on": Whenever a metacopy files specifies an expected digest, the corresponding data file must match the specified digest. When generating a metacopy file the verity digest will be set in it based on the source file (if it has one).h]j. )}(hhh]j3 )}(h"on": Whenever a metacopy files specifies an expected digest, the corresponding data file must match the specified digest. When generating a metacopy file the verity digest will be set in it based on the source file (if it has one).h](j9 )}(h"on":h]h “on”:}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhjvubjI )}(hhh]h)}(hWhenever a metacopy files specifies an expected digest, the corresponding data file must match the specified digest. When generating a metacopy file the verity digest will be set in it based on the source file (if it has one).h]hWhenever a metacopy files specifies an expected digest, the corresponding data file must match the specified digest. When generating a metacopy file the verity digest will be set in it based on the source file (if it has one).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jH hjvubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhjsubah}(h]h ]h"]h$]h&]uh1j- hjoubah}(h]h ]h"]h$]h&]uh1jhj*hhhNhNubj)}(h"require": Same as "on", but additionally all metacopy files must specify a digest (or EIO is returned on open). This means metadata copy up will only be used if the data file has fs-verity enabled, otherwise a full copy-up is used. h]j. )}(hhh]j3 )}(h"require": Same as "on", but additionally all metacopy files must specify a digest (or EIO is returned on open). This means metadata copy up will only be used if the data file has fs-verity enabled, otherwise a full copy-up is used. h](j9 )}(h "require":h]h“require”:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhjubjI )}(hhh]h)}(hSame as "on", but additionally all metacopy files must specify a digest (or EIO is returned on open). This means metadata copy up will only be used if the data file has fs-verity enabled, otherwise a full copy-up is used.h]hSame as “on”, but additionally all metacopy files must specify a digest (or EIO is returned on open). This means metadata copy up will only be used if the data file has fs-verity enabled, otherwise a full copy-up is used.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jH hjubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhjubah}(h]h ]h"]h$]h&]uh1j- hjubah}(h]h ]h"]h$]h&]uh1jhj*hhhNhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhMhjhhubeh}(h]fs-verity-supportah ]h"]fs-verity supportah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hSharing and copying layersh]hSharing and copying layers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM ubh)}(hXLower layers may be shared among several overlay mounts and that is indeed a very common practice. An overlay mount may use the same lower layer path as another overlay mount and it may use a lower layer path that is beneath or above the path of another overlay lower layer path.h]hXLower layers may be shared among several overlay mounts and that is indeed a very common practice. An overlay mount may use the same lower layer path as another overlay mount and it may use a lower layer path that is beneath or above the path of another overlay lower layer path.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjhhubh)}(hXUsing an upper layer path and/or a workdir path that are already used by another overlay mount is not allowed and may fail with EBUSY. Using partially overlapping paths is not allowed and may fail with EBUSY. If files are accessed from two overlayfs mounts which share or overlap the upper layer and/or workdir path the behavior of the overlay is undefined, though it will not result in a crash or deadlock.h]hXUsing an upper layer path and/or a workdir path that are already used by another overlay mount is not allowed and may fail with EBUSY. Using partially overlapping paths is not allowed and may fail with EBUSY. If files are accessed from two overlayfs mounts which share or overlap the upper layer and/or workdir path the behavior of the overlay is undefined, though it will not result in a crash or deadlock.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hMounting an overlay using an upper layer path, where the upper layer path was previously used by another mounted overlay in combination with a different lower layer path, is allowed, unless the "index" or "metacopy" features are enabled.h]hMounting an overlay using an upper layer path, where the upper layer path was previously used by another mounted overlay in combination with a different lower layer path, is allowed, unless the “index” or “metacopy” features are enabled.}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hXWith the "index" feature, on the first time mount, an NFS file handle of the lower layer root directory, along with the UUID of the lower filesystem, are encoded and stored in the "trusted.overlay.origin" extended attribute on the upper layer root directory. On subsequent mount attempts, the lower root directory file handle and lower filesystem UUID are compared to the stored origin in upper root directory. On failure to verify the lower root origin, mount will fail with ESTALE. An overlayfs mount with "index" enabled will fail with EOPNOTSUPP if the lower filesystem does not support NFS export, lower filesystem does not have a valid UUID or if the upper filesystem does not support extended attributes.h]hXWith the “index” feature, on the first time mount, an NFS file handle of the lower layer root directory, along with the UUID of the lower filesystem, are encoded and stored in the “trusted.overlay.origin” extended attribute on the upper layer root directory. On subsequent mount attempts, the lower root directory file handle and lower filesystem UUID are compared to the stored origin in upper root directory. On failure to verify the lower root origin, mount will fail with ESTALE. An overlayfs mount with “index” enabled will fail with EOPNOTSUPP if the lower filesystem does not support NFS export, lower filesystem does not have a valid UUID or if the upper filesystem does not support extended attributes.}(hj<hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hFor the "metacopy" feature, there is no verification mechanism at mount time. So if same upper is mounted with different set of lower, mount probably will succeed but expect the unexpected later on. So don't do it.h]hFor the “metacopy” feature, there is no verification mechanism at mount time. So if same upper is mounted with different set of lower, mount probably will succeed but expect the unexpected later on. So don’t do it.}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM(hjhhubh)}(hXIt is quite a common practice to copy overlay layers to a different directory tree on the same or different underlying filesystem, and even to a different machine. With the "index" feature, trying to mount the copied layers will fail the verification of the lower root file handle.h]hXIt is quite a common practice to copy overlay layers to a different directory tree on the same or different underlying filesystem, and even to a different machine. With the “index” feature, trying to mount the copied layers will fail the verification of the lower root file handle.}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM,hjhhubeh}(h]sharing-and-copying-layersah ]h"]sharing and copying layersah$]h&]uh1hhhhhhhhM ubh)}(hhh](h)}(hNesting overlayfs mountsh]hNesting overlayfs mounts}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjnhhhhhM2ubh)}(hX}It is possible to use a lower directory that is stored on an overlayfs mount. For regular files this does not need any special care. However, files that have overlayfs attributes, such as whiteouts or "overlay.*" xattrs, will be interpreted by the underlying overlayfs mount and stripped out. In order to allow the second overlayfs mount to see the attributes they must be escaped.h]hXIt is possible to use a lower directory that is stored on an overlayfs mount. For regular files this does not need any special care. However, files that have overlayfs attributes, such as whiteouts or “overlay.*” xattrs, will be interpreted by the underlying overlayfs mount and stripped out. In order to allow the second overlayfs mount to see the attributes they must be escaped.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM4hjnhhubh)}(hXhOverlayfs specific xattrs are escaped by using a special prefix of "overlay.overlay.". So, a file with a "trusted.overlay.overlay.metacopy" xattr in the lower dir will be exposed as a regular file with a "trusted.overlay.metacopy" xattr in the overlayfs mount. This can be nested by repeating the prefix multiple time, as each instance only removes one prefix.h]hXtOverlayfs specific xattrs are escaped by using a special prefix of “overlay.overlay.”. So, a file with a “trusted.overlay.overlay.metacopy” xattr in the lower dir will be exposed as a regular file with a “trusted.overlay.metacopy” xattr in the overlayfs mount. This can be nested by repeating the prefix multiple time, as each instance only removes one prefix.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM:hjnhhubh)}(hXA lower dir with a regular whiteout will always be handled by the overlayfs mount, so to support storing an effective whiteout file in an overlayfs mount an alternative form of whiteout is supported. This form is a regular, zero-size file with the "overlay.whiteout" xattr set, inside a directory with the "overlay.opaque" xattr set to "x" (see `whiteouts and opaque directories`_). These alternative whiteouts are never created by overlayfs, but can be used by userspace tools (like containers) that generate lower layers. These alternative whiteouts can be escaped using the standard xattr escape mechanism in order to properly nest to any depth.h](hXeA lower dir with a regular whiteout will always be handled by the overlayfs mount, so to support storing an effective whiteout file in an overlayfs mount an alternative form of whiteout is supported. This form is a regular, zero-size file with the “overlay.whiteout” xattr set, inside a directory with the “overlay.opaque” xattr set to “x” (see }(hjhhhNhNubh reference)}(h#`whiteouts and opaque directories`_h]h whiteouts and opaque directories}(hjhhhNhNubah}(h]h ]h"]h$]h&]name whiteouts and opaque directoriesrefidjuh1jhjresolvedKubhX ). These alternative whiteouts are never created by overlayfs, but can be used by userspace tools (like containers) that generate lower layers. These alternative whiteouts can be escaped using the standard xattr escape mechanism in order to properly nest to any depth.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM@hjnhhubeh}(h]nesting-overlayfs-mountsah ]h"]nesting overlayfs mountsah$]h&]uh1hhhhhhhhM2ubh)}(hhh](h)}(hNon-standard behaviorh]hNon-standard behavior}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMKubh)}(hLCurrent version of overlayfs can act as a mostly POSIX compliant filesystem.h]hLCurrent version of overlayfs can act as a mostly POSIX compliant filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMMhjhhubh)}(hBThis is the list of cases that overlayfs doesn't currently handle:h]hDThis is the list of cases that overlayfs doesn’t currently handle:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMPhjhhubj)}(hXa) POSIX mandates updating st_atime for reads. This is currently not done in the case when the file resides on a lower layer. b) If a file residing on a lower layer is opened for read-only and then memory mapped with MAP_SHARED, then subsequent changes to the file are not reflected in the memory mapping. c) If a file residing on a lower layer is being executed, then opening that file for write or truncating the file will not be denied with ETXTBSY. h]j)}(hhh](j)}(h|POSIX mandates updating st_atime for reads. This is currently not done in the case when the file resides on a lower layer. h]h)}(h{POSIX mandates updating st_atime for reads. This is currently not done in the case when the file resides on a lower layer.h]h{POSIX mandates updating st_atime for reads. This is currently not done in the case when the file resides on a lower layer.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMRhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hIf a file residing on a lower layer is opened for read-only and then memory mapped with MAP_SHARED, then subsequent changes to the file are not reflected in the memory mapping. h]h)}(hIf a file residing on a lower layer is opened for read-only and then memory mapped with MAP_SHARED, then subsequent changes to the file are not reflected in the memory mapping.h]hIf a file residing on a lower layer is opened for read-only and then memory mapped with MAP_SHARED, then subsequent changes to the file are not reflected in the memory mapping.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMUhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hIf a file residing on a lower layer is being executed, then opening that file for write or truncating the file will not be denied with ETXTBSY. h]h)}(hIf a file residing on a lower layer is being executed, then opening that file for write or truncating the file will not be denied with ETXTBSY.h]hIf a file residing on a lower layer is being executed, then opening that file for write or truncating the file will not be denied with ETXTBSY.}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMYhj-ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j j j hj j uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhMRhjhhubh)}(hXThe following options allow overlayfs to act more like a standards compliant filesystem:h]hXThe following options allow overlayfs to act more like a standards compliant filesystem:}(hjQhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM\hjhhubh)}(hhh](h)}(h redirect_dirh]h redirect_dir}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj_hhhhhM`ubh)}(hEnabled with the mount option or module option: "redirect_dir=on" or with the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.h]hEnabled with the mount option or module option: “redirect_dir=on” or with the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.}(hjphhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMbhj_hhubh)}(h~If this feature is disabled, then rename(2) on a lower or merged directory will fail with EXDEV ("Invalid cross-device link").h]hIf this feature is disabled, then rename(2) on a lower or merged directory will fail with EXDEV (“Invalid cross-device link”).}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMehj_hhubeh}(h] redirect-dirah ]h"] redirect_dirah$]h&]uh1hhjhhhhhM`ubh)}(hhh](h)}(hindexh]hindex}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMiubh)}(huEnabled with the mount option or module option "index=on" or with the kernel config option CONFIG_OVERLAY_FS_INDEX=y.h]hyEnabled with the mount option or module option “index=on” or with the kernel config option CONFIG_OVERLAY_FS_INDEX=y.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMkhjhhubh)}(hIf this feature is disabled and a file with multiple hard links is copied up, then this will "break" the link. Changes will not be propagated to other names referring to the same inode.h]hIf this feature is disabled and a file with multiple hard links is copied up, then this will “break” the link. Changes will not be propagated to other names referring to the same inode.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMnhjhhubeh}(h]indexah ]h"]indexah$]h&]uh1hhjhhhhhMiubh)}(hhh](h)}(hxinoh]hxino}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMsubh)}(hXEnabled with the mount option "xino=auto" or "xino=on", with the module option "xino_auto=on" or with the kernel config option CONFIG_OVERLAY_FS_XINO_AUTO=y. Also implicitly enabled by using the same underlying filesystem for all layers making up the overlay.h]hXEnabled with the mount option “xino=auto” or “xino=on”, with the module option “xino_auto=on” or with the kernel config option CONFIG_OVERLAY_FS_XINO_AUTO=y. Also implicitly enabled by using the same underlying filesystem for all layers making up the overlay.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMuhjhhubh)}(hX8If this feature is disabled or the underlying filesystem doesn't have enough free bits in the inode number, then overlayfs will not be able to guarantee that the values of st_ino and st_dev returned by stat(2) and the value of d_ino returned by readdir(3) will act like on a normal filesystem. E.g. the value of st_dev may be different for two objects in the same overlay filesystem and the value of st_ino for filesystem objects may not be persistent and could change even while the overlay filesystem is mounted, as summarized in the `Inode properties`_ table above.h](hXIf this feature is disabled or the underlying filesystem doesn’t have enough free bits in the inode number, then overlayfs will not be able to guarantee that the values of st_ino and st_dev returned by stat(2) and the value of d_ino returned by readdir(3) will act like on a normal filesystem. E.g. the value of st_dev may be different for two objects in the same overlay filesystem and the value of st_ino for filesystem objects may not be persistent and could change even while the overlay filesystem is mounted, as summarized in the }(hjhhhNhNubj)}(h`Inode properties`_h]hInode properties}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameInode propertiesjjuh1jhjjKubh table above.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMzhjhhubeh}(h]xinoah ]h"]xinoah$]h&]uh1hhjhhhhhMsubeh}(h]non-standard-behaviorah ]h"]non-standard behaviorah$]h&]uh1hhhhhhhhMKubh)}(hhh](h)}(h!Changes to underlying filesystemsh]h!Changes to underlying filesystems}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hChanges to the underlying filesystems while part of a mounted overlay filesystem are not allowed. If the underlying filesystem is changed, the behavior of the overlay is undefined, though it will not result in a crash or deadlock.h]hChanges to the underlying filesystems while part of a mounted overlay filesystem are not allowed. If the underlying filesystem is changed, the behavior of the overlay is undefined, though it will not result in a crash or deadlock.}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hX{Offline changes, when the overlay is not mounted, are allowed to the upper tree. Offline changes to the lower tree are only allowed if the "metacopy", "index", "xino" and "redirect_dir" features have not been used. If the lower tree is modified and any of these features has been used, the behavior of the overlay is undefined, though it will not result in a crash or deadlock.h]hXOffline changes, when the overlay is not mounted, are allowed to the upper tree. Offline changes to the lower tree are only allowed if the “metacopy”, “index”, “xino” and “redirect_dir” features have not been used. If the lower tree is modified and any of these features has been used, the behavior of the overlay is undefined, though it will not result in a crash or deadlock.}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hWhen the overlay NFS export feature is enabled, overlay filesystems behavior on offline changes of the underlying lower layer is different than the behavior when NFS export is disabled.h]hWhen the overlay NFS export feature is enabled, overlay filesystems behavior on offline changes of the underlying lower layer is different than the behavior when NFS export is disabled.}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hOn every copy_up, an NFS file handle of the lower inode, along with the UUID of the lower filesystem, are encoded and stored in an extended attribute "trusted.overlay.origin" on the upper inode.h]hOn every copy_up, an NFS file handle of the lower inode, along with the UUID of the lower filesystem, are encoded and stored in an extended attribute “trusted.overlay.origin” on the upper inode.}(hjUhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hXWhen the NFS export feature is enabled, a lookup of a merged directory, that found a lower directory at the lookup path or at the path pointed to by the "trusted.overlay.redirect" extended attribute, will verify that the found lower directory file handle and lower filesystem UUID match the origin file handle that was stored at copy_up time. If a found lower directory does not match the stored origin, that directory will not be merged with the upper directory.h]hXWhen the NFS export feature is enabled, a lookup of a merged directory, that found a lower directory at the lookup path or at the path pointed to by the “trusted.overlay.redirect” extended attribute, will verify that the found lower directory file handle and lower filesystem UUID match the origin file handle that was stored at copy_up time. If a found lower directory does not match the stored origin, that directory will not be merged with the upper directory.}(hjchhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]!changes-to-underlying-filesystemsah ]h"]!changes to underlying filesystemsah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(h NFS exporth]h NFS export}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjyhhhhhMubh)}(hWhen the underlying filesystems supports NFS export and the "nfs_export" feature is enabled, an overlay filesystem may be exported to NFS.h]hWhen the underlying filesystems supports NFS export and the “nfs_export” feature is enabled, an overlay filesystem may be exported to NFS.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hXWith the "nfs_export" feature, on copy_up of any lower object, an index entry is created under the index directory. The index entry name is the hexadecimal representation of the copy up origin file handle. For a non-directory object, the index entry is a hard link to the upper inode. For a directory object, the index entry has an extended attribute "trusted.overlay.upper" with an encoded file handle of the upper directory inode.h]hXWith the “nfs_export” feature, on copy_up of any lower object, an index entry is created under the index directory. The index entry name is the hexadecimal representation of the copy up origin file handle. For a non-directory object, the index entry is a hard link to the upper inode. For a directory object, the index entry has an extended attribute “trusted.overlay.upper” with an encoded file handle of the upper directory inode.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hYWhen encoding a file handle from an overlay filesystem object, the following rules apply:h]hYWhen encoding a file handle from an overlay filesystem object, the following rules apply:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubj)}(hX 1. For a non-upper object, encode a lower file handle from lower inode 2. For an indexed object, encode a lower file handle from copy_up origin 3. For a pure-upper object and for an existing non-indexed upper object, encode an upper file handle from upper inode h]j)}(hhh](j)}(hCFor a non-upper object, encode a lower file handle from lower inodeh]h)}(hjh]hCFor a non-upper object, encode a lower file handle from lower inode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hEFor an indexed object, encode a lower file handle from copy_up originh]h)}(hjh]hEFor an indexed object, encode a lower file handle from copy_up origin}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hsFor a pure-upper object and for an existing non-indexed upper object, encode an upper file handle from upper inode h]h)}(hrFor a pure-upper object and for an existing non-indexed upper object, encode an upper file handle from upper inodeh]hrFor a pure-upper object and for an existing non-indexed upper object, encode an upper file handle from upper inode}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j j j hj j uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhMhjyhhubh)}(h)The encoded overlay file handle includes:h]h)The encoded overlay file handle includes:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubj)}(h- Header including path type information (e.g. lower/upper) - UUID of the underlying filesystem - Underlying filesystem encoding of underlying inode h]j)}(hhh](j)}(h9Header including path type information (e.g. lower/upper)h]h)}(hj$h]h9Header including path type information (e.g. lower/upper)}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj"ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h!UUID of the underlying filesystemh]h)}(hj;h]h!UUID of the underlying filesystem}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj9ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h3Underlying filesystem encoding of underlying inode h]h)}(h2Underlying filesystem encoding of underlying inodeh]h2Underlying filesystem encoding of underlying inode}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjPubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]jjuh1jhhhMhjubah}(h]h ]h"]h$]h&]uh1jhhhMhjyhhubh)}(hThis encoding format is identical to the encoding format file handles that are stored in extended attribute "trusted.overlay.origin".h]hThis encoding format is identical to the encoding format file handles that are stored in extended attribute “trusted.overlay.origin”.}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hGWhen decoding an overlay file handle, the following steps are followed:h]hGWhen decoding an overlay file handle, the following steps are followed:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubj)}(hXi1. Find underlying layer by UUID and path type information. 2. Decode the underlying filesystem file handle to underlying dentry. 3. For a lower file handle, lookup the handle in index directory by name. 4. If a whiteout is found in index, return ESTALE. This represents an overlay object that was deleted after its file handle was encoded. 5. For a non-directory, instantiate a disconnected overlay dentry from the decoded underlying dentry, the path type and index inode, if found. 6. For a directory, use the connected underlying decoded dentry, path type and index, to lookup a connected overlay dentry. h]j)}(hhh](j)}(h8Find underlying layer by UUID and path type information.h]h)}(hjh]h8Find underlying layer by UUID and path type information.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hBDecode the underlying filesystem file handle to underlying dentry.h]h)}(hjh]hBDecode the underlying filesystem file handle to underlying dentry.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hFFor a lower file handle, lookup the handle in index directory by name.h]h)}(hjh]hFFor a lower file handle, lookup the handle in index directory by name.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hIf a whiteout is found in index, return ESTALE. This represents an overlay object that was deleted after its file handle was encoded.h]h)}(hIf a whiteout is found in index, return ESTALE. This represents an overlay object that was deleted after its file handle was encoded.h]hIf a whiteout is found in index, return ESTALE. This represents an overlay object that was deleted after its file handle was encoded.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hFor a non-directory, instantiate a disconnected overlay dentry from the decoded underlying dentry, the path type and index inode, if found.h]h)}(hFor a non-directory, instantiate a disconnected overlay dentry from the decoded underlying dentry, the path type and index inode, if found.h]hFor a non-directory, instantiate a disconnected overlay dentry from the decoded underlying dentry, the path type and index inode, if found.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hyFor a directory, use the connected underlying decoded dentry, path type and index, to lookup a connected overlay dentry. h]h)}(hxFor a directory, use the connected underlying decoded dentry, path type and index, to lookup a connected overlay dentry.h]hxFor a directory, use the connected underlying decoded dentry, path type and index, to lookup a connected overlay dentry.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j j j hj j uh1jhjubah}(h]h ]h"]h$]h&]uh1jhhhMhjyhhubh)}(hDecoding a non-directory file handle may return a disconnected dentry. copy_up of that disconnected dentry will create an upper index entry with no upper alias.h]hDecoding a non-directory file handle may return a disconnected dentry. copy_up of that disconnected dentry will create an upper index entry with no upper alias.}(hj0hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hXWhen overlay filesystem has multiple lower layers, a middle layer directory may have a "redirect" to lower directory. Because middle layer "redirects" are not indexed, a lower file handle that was encoded from the "redirect" origin directory, cannot be used to find the middle or upper layer directory. Similarly, a lower file handle that was encoded from a descendant of the "redirect" origin directory, cannot be used to reconstruct a connected overlay path. To mitigate the cases of directories that cannot be decoded from a lower file handle, these directories are copied up on encode and encoded as an upper file handle. On an overlay filesystem with no upper layer this mitigation cannot be used NFS export in this setup requires turning off redirect follow (e.g. "redirect_dir=nofollow").h]hX2When overlay filesystem has multiple lower layers, a middle layer directory may have a “redirect” to lower directory. Because middle layer “redirects” are not indexed, a lower file handle that was encoded from the “redirect” origin directory, cannot be used to find the middle or upper layer directory. Similarly, a lower file handle that was encoded from a descendant of the “redirect” origin directory, cannot be used to reconstruct a connected overlay path. To mitigate the cases of directories that cannot be decoded from a lower file handle, these directories are copied up on encode and encoded as an upper file handle. On an overlay filesystem with no upper layer this mitigation cannot be used NFS export in this setup requires turning off redirect follow (e.g. “redirect_dir=nofollow”).}(hj>hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hThe overlay filesystem does not support non-directory connectable file handles, so exporting with the 'subtree_check' exportfs configuration will cause failures to lookup files over NFS.h]hThe overlay filesystem does not support non-directory connectable file handles, so exporting with the ‘subtree_check’ exportfs configuration will cause failures to lookup files over NFS.}(hjLhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hWhen the NFS export feature is enabled, all directory index entries are verified on mount time to check that upper file handles are not stale. This verification may cause significant overhead in some cases.h]hWhen the NFS export feature is enabled, all directory index entries are verified on mount time to check that upper file handles are not stale. This verification may cause significant overhead in some cases.}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hsNote: the mount options index=off,nfs_export=on are conflicting for a read-write mount and will result in an error.h]hsNote: the mount options index=off,nfs_export=on are conflicting for a read-write mount and will result in an error.}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubh)}(hXNote: the mount option uuid=off can be used to replace UUID of the underlying filesystem in file handles with null, and effectively disable UUID checks. This can be useful in case the underlying disk is copied and the UUID of this copy is changed. This is only applicable if all lower/upper/work directories are on the same filesystem, otherwise it will fallback to normal behaviour.h]hXNote: the mount option uuid=off can be used to replace UUID of the underlying filesystem in file handles with null, and effectively disable UUID checks. This can be useful in case the underlying disk is copied and the UUID of this copy is changed. This is only applicable if all lower/upper/work directories are on the same filesystem, otherwise it will fallback to normal behaviour.}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjyhhubeh}(h] nfs-exportah ]h"] nfs exportah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(h UUID and fsidh]h UUID and fsid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hThe UUID of overlayfs instance itself and the fsid reported by statfs(2) are controlled by the "uuid" mount option, which supports these values:h]hThe UUID of overlayfs instance itself and the fsid reported by statfs(2) are controlled by the “uuid” mount option, which supports these values:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj)}(hhh](j)}(hN"null": UUID of overlayfs is null. fsid is taken from upper most filesystem.h]j. )}(hhh]j3 )}(hL"null": UUID of overlayfs is null. fsid is taken from upper most filesystem.h](j9 )}(h"null":h]h “null”:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhjubjI )}(hhh]h)}(hDUUID of overlayfs is null. fsid is taken from upper most filesystem.h]hDUUID of overlayfs is null. fsid is taken from upper most filesystem.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jH hjubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhjubah}(h]h ]h"]h$]h&]uh1j- hjubah}(h]h ]h"]h$]h&]uh1jhjhhhNhNubj)}(hu"off": UUID of overlayfs is null. fsid is taken from upper most filesystem. UUID of underlying layers is ignored.h]j. )}(hhh]j3 )}(hq"off": UUID of overlayfs is null. fsid is taken from upper most filesystem. UUID of underlying layers is ignored.h](j9 )}(h"off":h]h “off”:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhjubjI )}(hhh]h)}(hjUUID of overlayfs is null. fsid is taken from upper most filesystem. UUID of underlying layers is ignored.h]hjUUID of overlayfs is null. fsid is taken from upper most filesystem. UUID of underlying layers is ignored.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jH hjubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhjubah}(h]h ]h"]h$]h&]uh1j- hjubah}(h]h ]h"]h$]h&]uh1jhjhhhNhNubj)}(h"on": UUID of overlayfs is generated and used to report a unique fsid. UUID is stored in xattr "trusted.overlay.uuid", making overlayfs fsid unique and persistent. This option requires an overlayfs with upper filesystem that supports xattrs.h]j. )}(hhh]j3 )}(h"on": UUID of overlayfs is generated and used to report a unique fsid. UUID is stored in xattr "trusted.overlay.uuid", making overlayfs fsid unique and persistent. This option requires an overlayfs with upper filesystem that supports xattrs.h](j9 )}(h"on":h]h “on”:}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhMhj9ubjI )}(hhh]h)}(hUUID of overlayfs is generated and used to report a unique fsid. UUID is stored in xattr "trusted.overlay.uuid", making overlayfs fsid unique and persistent. This option requires an overlayfs with upper filesystem that supports xattrs.h]hUUID of overlayfs is generated and used to report a unique fsid. UUID is stored in xattr “trusted.overlay.uuid”, making overlayfs fsid unique and persistent. This option requires an overlayfs with upper filesystem that supports xattrs.}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjKubah}(h]h ]h"]h$]h&]uh1jH hj9ubeh}(h]h ]h"]h$]h&]uh1j2 hhhMhj6ubah}(h]h ]h"]h$]h&]uh1j- hj2ubah}(h]h ]h"]h$]h&]uh1jhjhhhNhNubj)}(hX"auto": (default) UUID is taken from xattr "trusted.overlay.uuid" if it exists. Upgrade to "uuid=on" on first time mount of new overlay filesystem that meets the prerequites. Downgrade to "uuid=null" for existing overlay filesystems that were never mounted with "uuid=on". h]j. )}(hhh]j3 )}(hX"auto": (default) UUID is taken from xattr "trusted.overlay.uuid" if it exists. Upgrade to "uuid=on" on first time mount of new overlay filesystem that meets the prerequites. Downgrade to "uuid=null" for existing overlay filesystems that were never mounted with "uuid=on". h](j9 )}(h"auto": (default)h]h“auto”: (default)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j8 hhhM hj{ubjI )}(hhh]h)}(hUUID is taken from xattr "trusted.overlay.uuid" if it exists. Upgrade to "uuid=on" on first time mount of new overlay filesystem that meets the prerequites. Downgrade to "uuid=null" for existing overlay filesystems that were never mounted with "uuid=on".h]hXUUID is taken from xattr “trusted.overlay.uuid” if it exists. Upgrade to “uuid=on” on first time mount of new overlay filesystem that meets the prerequites. Downgrade to “uuid=null” for existing overlay filesystems that were never mounted with “uuid=on”.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jH hj{ubeh}(h]h ]h"]h$]h&]uh1j2 hhhM hjxubah}(h]h ]h"]h$]h&]uh1j- hjtubah}(h]h ]h"]h$]h&]uh1jhjhhhNhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhMhjhhubeh}(h] uuid-and-fsidah ]h"] uuid and fsidah$]h&]uh1hhhhhhhhMubh)}(hhh](h)}(hVolatile mounth]hVolatile mount}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM ubh)}(hThis is enabled with the "volatile" mount option. Volatile mounts are not guaranteed to survive a crash. It is strongly recommended that volatile mounts are only used if data written to the overlay can be recreated without significant effort.h]hThis is enabled with the “volatile” mount option. Volatile mounts are not guaranteed to survive a crash. It is strongly recommended that volatile mounts are only used if data written to the overlay can be recreated without significant effort.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hyThe advantage of mounting with the "volatile" option is that all forms of sync calls to the upper filesystem are omitted.h]h}The advantage of mounting with the “volatile” option is that all forms of sync calls to the upper filesystem are omitted.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hXIn order to avoid a giving a false sense of safety, the syncfs (and fsync) semantics of volatile mounts are slightly different than that of the rest of VFS. If any writeback error occurs on the upperdir's filesystem after a volatile mount takes place, all sync functions will return an error. Once this condition is reached, the filesystem will not recover, and every subsequent sync call will return an error, even if the upperdir has not experience a new error since the last sync call.h]hXIn order to avoid a giving a false sense of safety, the syncfs (and fsync) semantics of volatile mounts are slightly different than that of the rest of VFS. If any writeback error occurs on the upperdir’s filesystem after a volatile mount takes place, all sync functions will return an error. Once this condition is reached, the filesystem will not recover, and every subsequent sync call will return an error, even if the upperdir has not experience a new error since the last sync call.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hXWhen overlay is mounted with "volatile" option, the directory "$workdir/work/incompat/volatile" is created. During next mount, overlay checks for this directory and refuses to mount if present. This is a strong indicator that user should throw away upper and work directories and create fresh one. In very limited cases where the user knows that the system has not crashed and contents of upperdir are intact, The "volatile" directory can be removed.h]hXWhen overlay is mounted with “volatile” option, the directory “$workdir/work/incompat/volatile” is created. During next mount, overlay checks for this directory and refuses to mount if present. This is a strong indicator that user should throw away upper and work directories and create fresh one. In very limited cases where the user knows that the system has not crashed and contents of upperdir are intact, The “volatile” directory can be removed.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]volatile-mountah ]h"]volatile mountah$]h&]uh1hhhhhhhhM ubh)}(hhh](h)}(h User xattrh]h User xattr}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM(ubh)}(hThe "-o userxattr" mount option forces overlayfs to use the "user.overlay." xattr namespace instead of "trusted.overlay.". This is useful for unprivileged mounting of overlayfs.h]hThe “-o userxattr” mount option forces overlayfs to use the “user.overlay.” xattr namespace instead of “trusted.overlay.”. This is useful for unprivileged mounting of overlayfs.}(hj&hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM*hjhhubeh}(h] user-xattrah ]h"] user xattrah$]h&]uh1hhhhhhhhM(ubh)}(hhh](h)}(h Testsuiteh]h Testsuite}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj<hhhhhM0ubh)}(hhThere's a testsuite originally developed by David Howells and currently maintained by Amir Goldstein at:h]hjThere’s a testsuite originally developed by David Howells and currently maintained by Amir Goldstein at:}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM2hj<hhubh)}(h4https://github.com/amir73il/unionmount-testsuite.gith]j)}(hj]h]h4https://github.com/amir73il/unionmount-testsuite.git}(hj_hhhNhNubah}(h]h ]h"]h$]h&]refurij]uh1jhj[ubah}(h]h ]h"]h$]h&]uh1hhhhM5hj<hhubh)}(h Run as root::h]h Run as root:}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM7hj<hhubj4)}(h/# cd unionmount-testsuite # ./run --ov --verifyh]h/# cd unionmount-testsuite # ./run --ov --verify}hjsbah}(h]h ]h"]h$]h&]hhuh1j3hhhM9hj<hhubeh}(h] testsuiteah ]h"] testsuiteah$]h&]uh1hhhhhhhhM0ubeh}(h]overlay-filesystemah ]h"]overlay filesystemah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksjfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}( whiteouts and opaque directories]jainode properties]jaurefids}nameids}(jjjjjjjjjrjojjjjj j j) j& j j j!jjjjj}jjjjjkjhjjjjjjjjjj jvjsjjjjjjj9j6jju nametypes}(jjjjjrjjj j) j j!jjjjjkjjjjjjvjjjj9juh}(jhjhjjLjjjojjjujjj jj& j j j, jj jj$j}jjjjjjhjjjnjjjj_jjj jjsjjjyjjjjj6jjj<u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.