overlayfs.rst 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628
  1. .. SPDX-License-Identifier: GPL-2.0
  2. Written by: Neil Brown
  3. Please see MAINTAINERS file for where to send questions.
  4. Overlay Filesystem
  5. ==================
  6. This document describes a prototype for a new approach to providing
  7. overlay-filesystem functionality in Linux (sometimes referred to as
  8. union-filesystems). An overlay-filesystem tries to present a
  9. filesystem which is the result over overlaying one filesystem on top
  10. of the other.
  11. Overlay objects
  12. ---------------
  13. The overlay filesystem approach is 'hybrid', because the objects that
  14. appear in the filesystem do not always appear to belong to that filesystem.
  15. In many cases, an object accessed in the union will be indistinguishable
  16. from accessing the corresponding object from the original filesystem.
  17. This is most obvious from the 'st_dev' field returned by stat(2).
  18. While directories will report an st_dev from the overlay-filesystem,
  19. non-directory objects may report an st_dev from the lower filesystem or
  20. upper filesystem that is providing the object. Similarly st_ino will
  21. only be unique when combined with st_dev, and both of these can change
  22. over the lifetime of a non-directory object. Many applications and
  23. tools ignore these values and will not be affected.
  24. In the special case of all overlay layers on the same underlying
  25. filesystem, all objects will report an st_dev from the overlay
  26. filesystem and st_ino from the underlying filesystem. This will
  27. make the overlay mount more compliant with filesystem scanners and
  28. overlay objects will be distinguishable from the corresponding
  29. objects in the original filesystem.
  30. On 64bit systems, even if all overlay layers are not on the same
  31. underlying filesystem, the same compliant behavior could be achieved
  32. with the "xino" feature. The "xino" feature composes a unique object
  33. identifier from the real object st_ino and an underlying fsid index.
  34. If all underlying filesystems support NFS file handles and export file
  35. handles with 32bit inode number encoding (e.g. ext4), overlay filesystem
  36. will use the high inode number bits for fsid. Even when the underlying
  37. filesystem uses 64bit inode numbers, users can still enable the "xino"
  38. feature with the "-o xino=on" overlay mount option. That is useful for the
  39. case of underlying filesystems like xfs and tmpfs, which use 64bit inode
  40. numbers, but are very unlikely to use the high inode number bits. In case
  41. the underlying inode number does overflow into the high xino bits, overlay
  42. filesystem will fall back to the non xino behavior for that inode.
  43. The following table summarizes what can be expected in different overlay
  44. configurations.
  45. Inode properties
  46. ````````````````
  47. +--------------+------------+------------+-----------------+----------------+
  48. |Configuration | Persistent | Uniform | st_ino == d_ino | d_ino == i_ino |
  49. | | st_ino | st_dev | | [*] |
  50. +==============+=====+======+=====+======+========+========+========+=======+
  51. | | dir | !dir | dir | !dir | dir + !dir | dir | !dir |
  52. +--------------+-----+------+-----+------+--------+--------+--------+-------+
  53. | All layers | Y | Y | Y | Y | Y | Y | Y | Y |
  54. | on same fs | | | | | | | | |
  55. +--------------+-----+------+-----+------+--------+--------+--------+-------+
  56. | Layers not | N | Y | Y | N | N | Y | N | Y |
  57. | on same fs, | | | | | | | | |
  58. | xino=off | | | | | | | | |
  59. +--------------+-----+------+-----+------+--------+--------+--------+-------+
  60. | xino=on/auto | Y | Y | Y | Y | Y | Y | Y | Y |
  61. | | | | | | | | | |
  62. +--------------+-----+------+-----+------+--------+--------+--------+-------+
  63. | xino=on/auto,| N | Y | Y | N | N | Y | N | Y |
  64. | ino overflow | | | | | | | | |
  65. +--------------+-----+------+-----+------+--------+--------+--------+-------+
  66. [*] nfsd v3 readdirplus verifies d_ino == i_ino. i_ino is exposed via several
  67. /proc files, such as /proc/locks and /proc/self/fdinfo/<fd> of an inotify
  68. file descriptor.
  69. Upper and Lower
  70. ---------------
  71. An overlay filesystem combines two filesystems - an 'upper' filesystem
  72. and a 'lower' filesystem. When a name exists in both filesystems, the
  73. object in the 'upper' filesystem is visible while the object in the
  74. 'lower' filesystem is either hidden or, in the case of directories,
  75. merged with the 'upper' object.
  76. It would be more correct to refer to an upper and lower 'directory
  77. tree' rather than 'filesystem' as it is quite possible for both
  78. directory trees to be in the same filesystem and there is no
  79. requirement that the root of a filesystem be given for either upper or
  80. lower.
  81. The lower filesystem can be any filesystem supported by Linux and does
  82. not need to be writable. The lower filesystem can even be another
  83. overlayfs. The upper filesystem will normally be writable and if it
  84. is it must support the creation of trusted.* extended attributes, and
  85. must provide valid d_type in readdir responses, so NFS is not suitable.
  86. A read-only overlay of two read-only filesystems may use any
  87. filesystem type.
  88. Directories
  89. -----------
  90. Overlaying mainly involves directories. If a given name appears in both
  91. upper and lower filesystems and refers to a non-directory in either,
  92. then the lower object is hidden - the name refers only to the upper
  93. object.
  94. Where both upper and lower objects are directories, a merged directory
  95. is formed.
  96. At mount time, the two directories given as mount options "lowerdir" and
  97. "upperdir" are combined into a merged directory:
  98. mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
  99. workdir=/work /merged
  100. The "workdir" needs to be an empty directory on the same filesystem
  101. as upperdir.
  102. Then whenever a lookup is requested in such a merged directory, the
  103. lookup is performed in each actual directory and the combined result
  104. is cached in the dentry belonging to the overlay filesystem. If both
  105. actual lookups find directories, both are stored and a merged
  106. directory is created, otherwise only one is stored: the upper if it
  107. exists, else the lower.
  108. Only the lists of names from directories are merged. Other content
  109. such as metadata and extended attributes are reported for the upper
  110. directory only. These attributes of the lower directory are hidden.
  111. credentials
  112. -----------
  113. By default, all access to the upper, lower and work directories is the
  114. recorded mounter's MAC and DAC credentials. The incoming accesses are
  115. checked against the caller's credentials.
  116. In the case where caller MAC or DAC credentials do not overlap, a
  117. use case available in older versions of the driver, the
  118. override_creds mount flag can be turned off and help when the use
  119. pattern has caller with legitimate credentials where the mounter
  120. does not. Several unintended side effects will occur though. The
  121. caller without certain key capabilities or lower privilege will not
  122. always be able to delete files or directories, create nodes, or
  123. search some restricted directories. The ability to search and read
  124. a directory entry is spotty as a result of the cache mechanism not
  125. retesting the credentials because of the assumption, a privileged
  126. caller can fill cache, then a lower privilege can read the directory
  127. cache. The uneven security model where cache, upperdir and workdir
  128. are opened at privilege, but accessed without creating a form of
  129. privilege escalation, should only be used with strict understanding
  130. of the side effects and of the security policies.
  131. whiteouts and opaque directories
  132. --------------------------------
  133. In order to support rm and rmdir without changing the lower
  134. filesystem, an overlay filesystem needs to record in the upper filesystem
  135. that files have been removed. This is done using whiteouts and opaque
  136. directories (non-directories are always opaque).
  137. A whiteout is created as a character device with 0/0 device number.
  138. When a whiteout is found in the upper level of a merged directory, any
  139. matching name in the lower level is ignored, and the whiteout itself
  140. is also hidden.
  141. A directory is made opaque by setting the xattr "trusted.overlay.opaque"
  142. to "y". Where the upper filesystem contains an opaque directory, any
  143. directory in the lower filesystem with the same name is ignored.
  144. readdir
  145. -------
  146. When a 'readdir' request is made on a merged directory, the upper and
  147. lower directories are each read and the name lists merged in the
  148. obvious way (upper is read first, then lower - entries that already
  149. exist are not re-added). This merged name list is cached in the
  150. 'struct file' and so remains as long as the file is kept open. If the
  151. directory is opened and read by two processes at the same time, they
  152. will each have separate caches. A seekdir to the start of the
  153. directory (offset 0) followed by a readdir will cause the cache to be
  154. discarded and rebuilt.
  155. This means that changes to the merged directory do not appear while a
  156. directory is being read. This is unlikely to be noticed by many
  157. programs.
  158. seek offsets are assigned sequentially when the directories are read.
  159. Thus if
  160. - read part of a directory
  161. - remember an offset, and close the directory
  162. - re-open the directory some time later
  163. - seek to the remembered offset
  164. there may be little correlation between the old and new locations in
  165. the list of filenames, particularly if anything has changed in the
  166. directory.
  167. Readdir on directories that are not merged is simply handled by the
  168. underlying directory (upper or lower).
  169. renaming directories
  170. --------------------
  171. When renaming a directory that is on the lower layer or merged (i.e. the
  172. directory was not created on the upper layer to start with) overlayfs can
  173. handle it in two different ways:
  174. 1. return EXDEV error: this error is returned by rename(2) when trying to
  175. move a file or directory across filesystem boundaries. Hence
  176. applications are usually prepared to hande this error (mv(1) for example
  177. recursively copies the directory tree). This is the default behavior.
  178. 2. If the "redirect_dir" feature is enabled, then the directory will be
  179. copied up (but not the contents). Then the "trusted.overlay.redirect"
  180. extended attribute is set to the path of the original location from the
  181. root of the overlay. Finally the directory is moved to the new
  182. location.
  183. There are several ways to tune the "redirect_dir" feature.
  184. Kernel config options:
  185. - OVERLAY_FS_REDIRECT_DIR:
  186. If this is enabled, then redirect_dir is turned on by default.
  187. - OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
  188. If this is enabled, then redirects are always followed by default. Enabling
  189. this results in a less secure configuration. Enable this option only when
  190. worried about backward compatibility with kernels that have the redirect_dir
  191. feature and follow redirects even if turned off.
  192. Module options (can also be changed through /sys/module/overlay/parameters/):
  193. - "redirect_dir=BOOL":
  194. See OVERLAY_FS_REDIRECT_DIR kernel config option above.
  195. - "redirect_always_follow=BOOL":
  196. See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
  197. - "redirect_max=NUM":
  198. The maximum number of bytes in an absolute redirect (default is 256).
  199. Mount options:
  200. - "redirect_dir=on":
  201. Redirects are enabled.
  202. - "redirect_dir=follow":
  203. Redirects are not created, but followed.
  204. - "redirect_dir=off":
  205. Redirects are not created and only followed if "redirect_always_follow"
  206. feature is enabled in the kernel/module config.
  207. - "redirect_dir=nofollow":
  208. Redirects are not created and not followed (equivalent to "redirect_dir=off"
  209. if "redirect_always_follow" feature is not enabled).
  210. When the NFS export feature is enabled, every copied up directory is
  211. indexed by the file handle of the lower inode and a file handle of the
  212. upper directory is stored in a "trusted.overlay.upper" extended attribute
  213. on the index entry. On lookup of a merged directory, if the upper
  214. directory does not match the file handle stores in the index, that is an
  215. indication that multiple upper directories may be redirected to the same
  216. lower directory. In that case, lookup returns an error and warns about
  217. a possible inconsistency.
  218. Because lower layer redirects cannot be verified with the index, enabling
  219. NFS export support on an overlay filesystem with no upper layer requires
  220. turning off redirect follow (e.g. "redirect_dir=nofollow").
  221. Non-directories
  222. ---------------
  223. Objects that are not directories (files, symlinks, device-special
  224. files etc.) are presented either from the upper or lower filesystem as
  225. appropriate. When a file in the lower filesystem is accessed in a way
  226. the requires write-access, such as opening for write access, changing
  227. some metadata etc., the file is first copied from the lower filesystem
  228. to the upper filesystem (copy_up). Note that creating a hard-link
  229. also requires copy_up, though of course creation of a symlink does
  230. not.
  231. The copy_up may turn out to be unnecessary, for example if the file is
  232. opened for read-write but the data is not modified.
  233. The copy_up process first makes sure that the containing directory
  234. exists in the upper filesystem - creating it and any parents as
  235. necessary. It then creates the object with the same metadata (owner,
  236. mode, mtime, symlink-target etc.) and then if the object is a file, the
  237. data is copied from the lower to the upper filesystem. Finally any
  238. extended attributes are copied up.
  239. Once the copy_up is complete, the overlay filesystem simply
  240. provides direct access to the newly created file in the upper
  241. filesystem - future operations on the file are barely noticed by the
  242. overlay filesystem (though an operation on the name of the file such as
  243. rename or unlink will of course be noticed and handled).
  244. Permission model
  245. ----------------
  246. Permission checking in the overlay filesystem follows these principles:
  247. 1) permission check SHOULD return the same result before and after copy up
  248. 2) task creating the overlay mount MUST NOT gain additional privileges
  249. 3) non-mounting task MAY gain additional privileges through the overlay,
  250. compared to direct access on underlying lower or upper filesystems
  251. This is achieved by performing two permission checks on each access
  252. a) check if current task is allowed access based on local DAC (owner,
  253. group, mode and posix acl), as well as MAC checks
  254. b) check if mounting task would be allowed real operation on lower or
  255. upper layer based on underlying filesystem permissions, again including
  256. MAC checks
  257. Check (a) ensures consistency (1) since owner, group, mode and posix acls
  258. are copied up. On the other hand it can result in server enforced
  259. permissions (used by NFS, for example) being ignored (3).
  260. Check (b) ensures that no task gains permissions to underlying layers that
  261. the mounting task does not have (2). This also means that it is possible
  262. to create setups where the consistency rule (1) does not hold; normally,
  263. however, the mounting task will have sufficient privileges to perform all
  264. operations.
  265. Another way to demonstrate this model is drawing parallels between
  266. mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,... /merged
  267. and
  268. cp -a /lower /upper
  269. mount --bind /upper /merged
  270. The resulting access permissions should be the same. The difference is in
  271. the time of copy (on-demand vs. up-front).
  272. Multiple lower layers
  273. ---------------------
  274. Multiple lower layers can now be given using the colon (":") as a
  275. separator character between the directory names. For example:
  276. mount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged
  277. As the example shows, "upperdir=" and "workdir=" may be omitted. In
  278. that case the overlay will be read-only.
  279. The specified lower directories will be stacked beginning from the
  280. rightmost one and going left. In the above example lower1 will be the
  281. top, lower2 the middle and lower3 the bottom layer.
  282. Metadata only copy up
  283. ---------------------
  284. When metadata only copy up feature is enabled, overlayfs will only copy
  285. up metadata (as opposed to whole file), when a metadata specific operation
  286. like chown/chmod is performed. Full file will be copied up later when
  287. file is opened for WRITE operation.
  288. In other words, this is delayed data copy up operation and data is copied
  289. up when there is a need to actually modify data.
  290. There are multiple ways to enable/disable this feature. A config option
  291. CONFIG_OVERLAY_FS_METACOPY can be set/unset to enable/disable this feature
  292. by default. Or one can enable/disable it at module load time with module
  293. parameter metacopy=on/off. Lastly, there is also a per mount option
  294. metacopy=on/off to enable/disable this feature per mount.
  295. Do not use metacopy=on with untrusted upper/lower directories. Otherwise
  296. it is possible that an attacker can create a handcrafted file with
  297. appropriate REDIRECT and METACOPY xattrs, and gain access to file on lower
  298. pointed by REDIRECT. This should not be possible on local system as setting
  299. "trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
  300. for untrusted layers like from a pen drive.
  301. Note: redirect_dir={off|nofollow|follow[*]} and nfs_export=on mount options
  302. conflict with metacopy=on, and will result in an error.
  303. [*] redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
  304. given.
  305. Sharing and copying layers
  306. --------------------------
  307. Lower layers may be shared among several overlay mounts and that is indeed
  308. a very common practice. An overlay mount may use the same lower layer
  309. path as another overlay mount and it may use a lower layer path that is
  310. beneath or above the path of another overlay lower layer path.
  311. Using an upper layer path and/or a workdir path that are already used by
  312. another overlay mount is not allowed and may fail with EBUSY. Using
  313. partially overlapping paths is not allowed and may fail with EBUSY.
  314. If files are accessed from two overlayfs mounts which share or overlap the
  315. upper layer and/or workdir path the behavior of the overlay is undefined,
  316. though it will not result in a crash or deadlock.
  317. Mounting an overlay using an upper layer path, where the upper layer path
  318. was previously used by another mounted overlay in combination with a
  319. different lower layer path, is allowed, unless the "inodes index" feature
  320. or "metadata only copy up" feature is enabled.
  321. With the "inodes index" feature, on the first time mount, an NFS file
  322. handle of the lower layer root directory, along with the UUID of the lower
  323. filesystem, are encoded and stored in the "trusted.overlay.origin" extended
  324. attribute on the upper layer root directory. On subsequent mount attempts,
  325. the lower root directory file handle and lower filesystem UUID are compared
  326. to the stored origin in upper root directory. On failure to verify the
  327. lower root origin, mount will fail with ESTALE. An overlayfs mount with
  328. "inodes index" enabled will fail with EOPNOTSUPP if the lower filesystem
  329. does not support NFS export, lower filesystem does not have a valid UUID or
  330. if the upper filesystem does not support extended attributes.
  331. For "metadata only copy up" feature there is no verification mechanism at
  332. mount time. So if same upper is mounted with different set of lower, mount
  333. probably will succeed but expect the unexpected later on. So don't do it.
  334. It is quite a common practice to copy overlay layers to a different
  335. directory tree on the same or different underlying filesystem, and even
  336. to a different machine. With the "inodes index" feature, trying to mount
  337. the copied layers will fail the verification of the lower root file handle.
  338. Non-standard behavior
  339. ---------------------
  340. Current version of overlayfs can act as a mostly POSIX compliant
  341. filesystem.
  342. This is the list of cases that overlayfs doesn't currently handle:
  343. a) POSIX mandates updating st_atime for reads. This is currently not
  344. done in the case when the file resides on a lower layer.
  345. b) If a file residing on a lower layer is opened for read-only and then
  346. memory mapped with MAP_SHARED, then subsequent changes to the file are not
  347. reflected in the memory mapping.
  348. The following options allow overlayfs to act more like a standards
  349. compliant filesystem:
  350. 1) "redirect_dir"
  351. Enabled with the mount option or module option: "redirect_dir=on" or with
  352. the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.
  353. If this feature is disabled, then rename(2) on a lower or merged directory
  354. will fail with EXDEV ("Invalid cross-device link").
  355. 2) "inode index"
  356. Enabled with the mount option or module option "index=on" or with the
  357. kernel config option CONFIG_OVERLAY_FS_INDEX=y.
  358. If this feature is disabled and a file with multiple hard links is copied
  359. up, then this will "break" the link. Changes will not be propagated to
  360. other names referring to the same inode.
  361. 3) "xino"
  362. Enabled with the mount option "xino=auto" or "xino=on", with the module
  363. option "xino_auto=on" or with the kernel config option
  364. CONFIG_OVERLAY_FS_XINO_AUTO=y. Also implicitly enabled by using the same
  365. underlying filesystem for all layers making up the overlay.
  366. If this feature is disabled or the underlying filesystem doesn't have
  367. enough free bits in the inode number, then overlayfs will not be able to
  368. guarantee that the values of st_ino and st_dev returned by stat(2) and the
  369. value of d_ino returned by readdir(3) will act like on a normal filesystem.
  370. E.g. the value of st_dev may be different for two objects in the same
  371. overlay filesystem and the value of st_ino for directory objects may not be
  372. persistent and could change even while the overlay filesystem is mounted, as
  373. summarized in the `Inode properties`_ table above.
  374. Changes to underlying filesystems
  375. ---------------------------------
  376. Offline changes, when the overlay is not mounted, are allowed to either
  377. the upper or the lower trees.
  378. Changes to the underlying filesystems while part of a mounted overlay
  379. filesystem are not allowed. If the underlying filesystem is changed,
  380. the behavior of the overlay is undefined, though it will not result in
  381. a crash or deadlock.
  382. When the overlay NFS export feature is enabled, overlay filesystems
  383. behavior on offline changes of the underlying lower layer is different
  384. than the behavior when NFS export is disabled.
  385. On every copy_up, an NFS file handle of the lower inode, along with the
  386. UUID of the lower filesystem, are encoded and stored in an extended
  387. attribute "trusted.overlay.origin" on the upper inode.
  388. When the NFS export feature is enabled, a lookup of a merged directory,
  389. that found a lower directory at the lookup path or at the path pointed
  390. to by the "trusted.overlay.redirect" extended attribute, will verify
  391. that the found lower directory file handle and lower filesystem UUID
  392. match the origin file handle that was stored at copy_up time. If a
  393. found lower directory does not match the stored origin, that directory
  394. will not be merged with the upper directory.
  395. NFS export
  396. ----------
  397. When the underlying filesystems supports NFS export and the "nfs_export"
  398. feature is enabled, an overlay filesystem may be exported to NFS.
  399. With the "nfs_export" feature, on copy_up of any lower object, an index
  400. entry is created under the index directory. The index entry name is the
  401. hexadecimal representation of the copy up origin file handle. For a
  402. non-directory object, the index entry is a hard link to the upper inode.
  403. For a directory object, the index entry has an extended attribute
  404. "trusted.overlay.upper" with an encoded file handle of the upper
  405. directory inode.
  406. When encoding a file handle from an overlay filesystem object, the
  407. following rules apply:
  408. 1. For a non-upper object, encode a lower file handle from lower inode
  409. 2. For an indexed object, encode a lower file handle from copy_up origin
  410. 3. For a pure-upper object and for an existing non-indexed upper object,
  411. encode an upper file handle from upper inode
  412. The encoded overlay file handle includes:
  413. - Header including path type information (e.g. lower/upper)
  414. - UUID of the underlying filesystem
  415. - Underlying filesystem encoding of underlying inode
  416. This encoding format is identical to the encoding format file handles that
  417. are stored in extended attribute "trusted.overlay.origin".
  418. When decoding an overlay file handle, the following steps are followed:
  419. 1. Find underlying layer by UUID and path type information.
  420. 2. Decode the underlying filesystem file handle to underlying dentry.
  421. 3. For a lower file handle, lookup the handle in index directory by name.
  422. 4. If a whiteout is found in index, return ESTALE. This represents an
  423. overlay object that was deleted after its file handle was encoded.
  424. 5. For a non-directory, instantiate a disconnected overlay dentry from the
  425. decoded underlying dentry, the path type and index inode, if found.
  426. 6. For a directory, use the connected underlying decoded dentry, path type
  427. and index, to lookup a connected overlay dentry.
  428. Decoding a non-directory file handle may return a disconnected dentry.
  429. copy_up of that disconnected dentry will create an upper index entry with
  430. no upper alias.
  431. When overlay filesystem has multiple lower layers, a middle layer
  432. directory may have a "redirect" to lower directory. Because middle layer
  433. "redirects" are not indexed, a lower file handle that was encoded from the
  434. "redirect" origin directory, cannot be used to find the middle or upper
  435. layer directory. Similarly, a lower file handle that was encoded from a
  436. descendant of the "redirect" origin directory, cannot be used to
  437. reconstruct a connected overlay path. To mitigate the cases of
  438. directories that cannot be decoded from a lower file handle, these
  439. directories are copied up on encode and encoded as an upper file handle.
  440. On an overlay filesystem with no upper layer this mitigation cannot be
  441. used NFS export in this setup requires turning off redirect follow (e.g.
  442. "redirect_dir=nofollow").
  443. The overlay filesystem does not support non-directory connectable file
  444. handles, so exporting with the 'subtree_check' exportfs configuration will
  445. cause failures to lookup files over NFS.
  446. When the NFS export feature is enabled, all directory index entries are
  447. verified on mount time to check that upper file handles are not stale.
  448. This verification may cause significant overhead in some cases.
  449. Note: the mount options index=off,nfs_export=on are conflicting for a
  450. read-write mount and will result in an error.
  451. Volatile mount
  452. --------------
  453. This is enabled with the "volatile" mount option. Volatile mounts are not
  454. guaranteed to survive a crash. It is strongly recommended that volatile
  455. mounts are only used if data written to the overlay can be recreated
  456. without significant effort.
  457. The advantage of mounting with the "volatile" option is that all forms of
  458. sync calls to the upper filesystem are omitted.
  459. In order to avoid a giving a false sense of safety, the syncfs (and fsync)
  460. semantics of volatile mounts are slightly different than that of the rest of
  461. VFS. If any writeback error occurs on the upperdir's filesystem after a
  462. volatile mount takes place, all sync functions will return an error. Once this
  463. condition is reached, the filesystem will not recover, and every subsequent sync
  464. call will return an error, even if the upperdir has not experience a new error
  465. since the last sync call.
  466. When overlay is mounted with "volatile" option, the directory
  467. "$workdir/work/incompat/volatile" is created. During next mount, overlay
  468. checks for this directory and refuses to mount if present. This is a strong
  469. indicator that user should throw away upper and work directories and create
  470. fresh one. In very limited cases where the user knows that the system has
  471. not crashed and contents of upperdir are intact, The "volatile" directory
  472. can be removed.
  473. Testsuite
  474. ---------
  475. There's a testsuite originally developed by David Howells and currently
  476. maintained by Amir Goldstein at:
  477. https://github.com/amir73il/unionmount-testsuite.git
  478. Run as root:
  479. # cd unionmount-testsuite
  480. # ./run --ov --verify