1Written by: Neil Brown
2Please see MAINTAINERS file for where to send questions.
3
4Overlay Filesystem
5==================
6
7This document describes a prototype for a new approach to providing
8overlay-filesystem functionality in Linux (sometimes referred to as
9union-filesystems).  An overlay-filesystem tries to present a
10filesystem which is the result over overlaying one filesystem on top
11of the other.
12
13
14Overlay objects
15---------------
16
17The overlay filesystem approach is 'hybrid', because the objects that
18appear in the filesystem do not always appear to belong to that filesystem.
19In many cases, an object accessed in the union will be indistinguishable
20from accessing the corresponding object from the original filesystem.
21This is most obvious from the 'st_dev' field returned by stat(2).
22
23While directories will report an st_dev from the overlay-filesystem,
24non-directory objects may report an st_dev from the lower filesystem or
25upper filesystem that is providing the object.  Similarly st_ino will
26only be unique when combined with st_dev, and both of these can change
27over the lifetime of a non-directory object.  Many applications and
28tools ignore these values and will not be affected.
29
30In the special case of all overlay layers on the same underlying
31filesystem, all objects will report an st_dev from the overlay
32filesystem and st_ino from the underlying filesystem.  This will
33make the overlay mount more compliant with filesystem scanners and
34overlay objects will be distinguishable from the corresponding
35objects in the original filesystem.
36
37On 64bit systems, even if all overlay layers are not on the same
38underlying filesystem, the same compliant behavior could be achieved
39with the "xino" feature.  The "xino" feature composes a unique object
40identifier from the real object st_ino and an underlying fsid index.
41If all underlying filesystems support NFS file handles and export file
42handles with 32bit inode number encoding (e.g. ext4), overlay filesystem
43will use the high inode number bits for fsid.  Even when the underlying
44filesystem uses 64bit inode numbers, users can still enable the "xino"
45feature with the "-o xino=on" overlay mount option.  That is useful for the
46case of underlying filesystems like xfs and tmpfs, which use 64bit inode
47numbers, but are very unlikely to use the high inode number bit.
48
49
50Upper and Lower
51---------------
52
53An overlay filesystem combines two filesystems - an 'upper' filesystem
54and a 'lower' filesystem.  When a name exists in both filesystems, the
55object in the 'upper' filesystem is visible while the object in the
56'lower' filesystem is either hidden or, in the case of directories,
57merged with the 'upper' object.
58
59It would be more correct to refer to an upper and lower 'directory
60tree' rather than 'filesystem' as it is quite possible for both
61directory trees to be in the same filesystem and there is no
62requirement that the root of a filesystem be given for either upper or
63lower.
64
65The lower filesystem can be any filesystem supported by Linux and does
66not need to be writable.  The lower filesystem can even be another
67overlayfs.  The upper filesystem will normally be writable and if it
68is it must support the creation of trusted.* extended attributes, and
69must provide valid d_type in readdir responses, so NFS is not suitable.
70
71A read-only overlay of two read-only filesystems may use any
72filesystem type.
73
74Directories
75-----------
76
77Overlaying mainly involves directories.  If a given name appears in both
78upper and lower filesystems and refers to a non-directory in either,
79then the lower object is hidden - the name refers only to the upper
80object.
81
82Where both upper and lower objects are directories, a merged directory
83is formed.
84
85At mount time, the two directories given as mount options "lowerdir" and
86"upperdir" are combined into a merged directory:
87
88  mount -t overlay overlay -olowerdir=/lower,upperdir=/upper,\
89  workdir=/work /merged
90
91The "workdir" needs to be an empty directory on the same filesystem
92as upperdir.
93
94Then whenever a lookup is requested in such a merged directory, the
95lookup is performed in each actual directory and the combined result
96is cached in the dentry belonging to the overlay filesystem.  If both
97actual lookups find directories, both are stored and a merged
98directory is created, otherwise only one is stored: the upper if it
99exists, else the lower.
100
101Only the lists of names from directories are merged.  Other content
102such as metadata and extended attributes are reported for the upper
103directory only.  These attributes of the lower directory are hidden.
104
105whiteouts and opaque directories
106--------------------------------
107
108In order to support rm and rmdir without changing the lower
109filesystem, an overlay filesystem needs to record in the upper filesystem
110that files have been removed.  This is done using whiteouts and opaque
111directories (non-directories are always opaque).
112
113A whiteout is created as a character device with 0/0 device number.
114When a whiteout is found in the upper level of a merged directory, any
115matching name in the lower level is ignored, and the whiteout itself
116is also hidden.
117
118A directory is made opaque by setting the xattr "trusted.overlay.opaque"
119to "y".  Where the upper filesystem contains an opaque directory, any
120directory in the lower filesystem with the same name is ignored.
121
122readdir
123-------
124
125When a 'readdir' request is made on a merged directory, the upper and
126lower directories are each read and the name lists merged in the
127obvious way (upper is read first, then lower - entries that already
128exist are not re-added).  This merged name list is cached in the
129'struct file' and so remains as long as the file is kept open.  If the
130directory is opened and read by two processes at the same time, they
131will each have separate caches.  A seekdir to the start of the
132directory (offset 0) followed by a readdir will cause the cache to be
133discarded and rebuilt.
134
135This means that changes to the merged directory do not appear while a
136directory is being read.  This is unlikely to be noticed by many
137programs.
138
139seek offsets are assigned sequentially when the directories are read.
140Thus if
141
142  - read part of a directory
143  - remember an offset, and close the directory
144  - re-open the directory some time later
145  - seek to the remembered offset
146
147there may be little correlation between the old and new locations in
148the list of filenames, particularly if anything has changed in the
149directory.
150
151Readdir on directories that are not merged is simply handled by the
152underlying directory (upper or lower).
153
154renaming directories
155--------------------
156
157When renaming a directory that is on the lower layer or merged (i.e. the
158directory was not created on the upper layer to start with) overlayfs can
159handle it in two different ways:
160
1611. return EXDEV error: this error is returned by rename(2) when trying to
162   move a file or directory across filesystem boundaries.  Hence
163   applications are usually prepared to hande this error (mv(1) for example
164   recursively copies the directory tree).  This is the default behavior.
165
1662. If the "redirect_dir" feature is enabled, then the directory will be
167   copied up (but not the contents).  Then the "trusted.overlay.redirect"
168   extended attribute is set to the path of the original location from the
169   root of the overlay.  Finally the directory is moved to the new
170   location.
171
172There are several ways to tune the "redirect_dir" feature.
173
174Kernel config options:
175
176- OVERLAY_FS_REDIRECT_DIR:
177    If this is enabled, then redirect_dir is turned on by  default.
178- OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW:
179    If this is enabled, then redirects are always followed by default. Enabling
180    this results in a less secure configuration.  Enable this option only when
181    worried about backward compatibility with kernels that have the redirect_dir
182    feature and follow redirects even if turned off.
183
184Module options (can also be changed through /sys/module/overlay/parameters/*):
185
186- "redirect_dir=BOOL":
187    See OVERLAY_FS_REDIRECT_DIR kernel config option above.
188- "redirect_always_follow=BOOL":
189    See OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW kernel config option above.
190- "redirect_max=NUM":
191    The maximum number of bytes in an absolute redirect (default is 256).
192
193Mount options:
194
195- "redirect_dir=on":
196    Redirects are enabled.
197- "redirect_dir=follow":
198    Redirects are not created, but followed.
199- "redirect_dir=off":
200    Redirects are not created and only followed if "redirect_always_follow"
201    feature is enabled in the kernel/module config.
202- "redirect_dir=nofollow":
203    Redirects are not created and not followed (equivalent to "redirect_dir=off"
204    if "redirect_always_follow" feature is not enabled).
205
206When the NFS export feature is enabled, every copied up directory is
207indexed by the file handle of the lower inode and a file handle of the
208upper directory is stored in a "trusted.overlay.upper" extended attribute
209on the index entry.  On lookup of a merged directory, if the upper
210directory does not match the file handle stores in the index, that is an
211indication that multiple upper directories may be redirected to the same
212lower directory.  In that case, lookup returns an error and warns about
213a possible inconsistency.
214
215Because lower layer redirects cannot be verified with the index, enabling
216NFS export support on an overlay filesystem with no upper layer requires
217turning off redirect follow (e.g. "redirect_dir=nofollow").
218
219
220Non-directories
221---------------
222
223Objects that are not directories (files, symlinks, device-special
224files etc.) are presented either from the upper or lower filesystem as
225appropriate.  When a file in the lower filesystem is accessed in a way
226the requires write-access, such as opening for write access, changing
227some metadata etc., the file is first copied from the lower filesystem
228to the upper filesystem (copy_up).  Note that creating a hard-link
229also requires copy_up, though of course creation of a symlink does
230not.
231
232The copy_up may turn out to be unnecessary, for example if the file is
233opened for read-write but the data is not modified.
234
235The copy_up process first makes sure that the containing directory
236exists in the upper filesystem - creating it and any parents as
237necessary.  It then creates the object with the same metadata (owner,
238mode, mtime, symlink-target etc.) and then if the object is a file, the
239data is copied from the lower to the upper filesystem.  Finally any
240extended attributes are copied up.
241
242Once the copy_up is complete, the overlay filesystem simply
243provides direct access to the newly created file in the upper
244filesystem - future operations on the file are barely noticed by the
245overlay filesystem (though an operation on the name of the file such as
246rename or unlink will of course be noticed and handled).
247
248
249Multiple lower layers
250---------------------
251
252Multiple lower layers can now be given using the the colon (":") as a
253separator character between the directory names.  For example:
254
255  mount -t overlay overlay -olowerdir=/lower1:/lower2:/lower3 /merged
256
257As the example shows, "upperdir=" and "workdir=" may be omitted.  In
258that case the overlay will be read-only.
259
260The specified lower directories will be stacked beginning from the
261rightmost one and going left.  In the above example lower1 will be the
262top, lower2 the middle and lower3 the bottom layer.
263
264
265Metadata only copy up
266--------------------
267
268When metadata only copy up feature is enabled, overlayfs will only copy
269up metadata (as opposed to whole file), when a metadata specific operation
270like chown/chmod is performed. Full file will be copied up later when
271file is opened for WRITE operation.
272
273In other words, this is delayed data copy up operation and data is copied
274up when there is a need to actually modify data.
275
276There are multiple ways to enable/disable this feature. A config option
277CONFIG_OVERLAY_FS_METACOPY can be set/unset to enable/disable this feature
278by default. Or one can enable/disable it at module load time with module
279parameter metacopy=on/off. Lastly, there is also a per mount option
280metacopy=on/off to enable/disable this feature per mount.
281
282Do not use metacopy=on with untrusted upper/lower directories. Otherwise
283it is possible that an attacker can create a handcrafted file with
284appropriate REDIRECT and METACOPY xattrs, and gain access to file on lower
285pointed by REDIRECT. This should not be possible on local system as setting
286"trusted." xattrs will require CAP_SYS_ADMIN. But it should be possible
287for untrusted layers like from a pen drive.
288
289Note: redirect_dir={off|nofollow|follow(*)} conflicts with metacopy=on, and
290results in an error.
291
292(*) redirect_dir=follow only conflicts with metacopy=on if upperdir=... is
293given.
294
295Sharing and copying layers
296--------------------------
297
298Lower layers may be shared among several overlay mounts and that is indeed
299a very common practice.  An overlay mount may use the same lower layer
300path as another overlay mount and it may use a lower layer path that is
301beneath or above the path of another overlay lower layer path.
302
303Using an upper layer path and/or a workdir path that are already used by
304another overlay mount is not allowed and may fail with EBUSY.  Using
305partially overlapping paths is not allowed and may fail with EBUSY.
306If files are accessed from two overlayfs mounts which share or overlap the
307upper layer and/or workdir path the behavior of the overlay is undefined,
308though it will not result in a crash or deadlock.
309
310Mounting an overlay using an upper layer path, where the upper layer path
311was previously used by another mounted overlay in combination with a
312different lower layer path, is allowed, unless the "inodes index" feature
313or "metadata only copy up" feature is enabled.
314
315With the "inodes index" feature, on the first time mount, an NFS file
316handle of the lower layer root directory, along with the UUID of the lower
317filesystem, are encoded and stored in the "trusted.overlay.origin" extended
318attribute on the upper layer root directory.  On subsequent mount attempts,
319the lower root directory file handle and lower filesystem UUID are compared
320to the stored origin in upper root directory.  On failure to verify the
321lower root origin, mount will fail with ESTALE.  An overlayfs mount with
322"inodes index" enabled will fail with EOPNOTSUPP if the lower filesystem
323does not support NFS export, lower filesystem does not have a valid UUID or
324if the upper filesystem does not support extended attributes.
325
326For "metadata only copy up" feature there is no verification mechanism at
327mount time. So if same upper is mounted with different set of lower, mount
328probably will succeed but expect the unexpected later on. So don't do it.
329
330It is quite a common practice to copy overlay layers to a different
331directory tree on the same or different underlying filesystem, and even
332to a different machine.  With the "inodes index" feature, trying to mount
333the copied layers will fail the verification of the lower root file handle.
334
335
336Non-standard behavior
337---------------------
338
339Current version of overlayfs can act as a mostly POSIX compliant
340filesystem.
341
342This is the list of cases that overlayfs doesn't currently handle:
343
344a) POSIX mandates updating st_atime for reads.  This is currently not
345done in the case when the file resides on a lower layer.
346
347b) If a file residing on a lower layer is opened for read-only and then
348memory mapped with MAP_SHARED, then subsequent changes to the file are not
349reflected in the memory mapping.
350
351The following options allow overlayfs to act more like a standards
352compliant filesystem:
353
3541) "redirect_dir"
355
356Enabled with the mount option or module option: "redirect_dir=on" or with
357the kernel config option CONFIG_OVERLAY_FS_REDIRECT_DIR=y.
358
359If this feature is disabled, then rename(2) on a lower or merged directory
360will fail with EXDEV ("Invalid cross-device link").
361
3622) "inode index"
363
364Enabled with the mount option or module option "index=on" or with the
365kernel config option CONFIG_OVERLAY_FS_INDEX=y.
366
367If this feature is disabled and a file with multiple hard links is copied
368up, then this will "break" the link.  Changes will not be propagated to
369other names referring to the same inode.
370
3713) "xino"
372
373Enabled with the mount option "xino=auto" or "xino=on", with the module
374option "xino_auto=on" or with the kernel config option
375CONFIG_OVERLAY_FS_XINO_AUTO=y.  Also implicitly enabled by using the same
376underlying filesystem for all layers making up the overlay.
377
378If this feature is disabled or the underlying filesystem doesn't have
379enough free bits in the inode number, then overlayfs will not be able to
380guarantee that the values of st_ino and st_dev returned by stat(2) and the
381value of d_ino returned by readdir(3) will act like on a normal filesystem.
382E.g. the value of st_dev may be different for two objects in the same
383overlay filesystem and the value of st_ino for directory objects may not be
384persistent and could change even while the overlay filesystem is mounted.
385
386
387Changes to underlying filesystems
388---------------------------------
389
390Offline changes, when the overlay is not mounted, are allowed to either
391the upper or the lower trees.
392
393Changes to the underlying filesystems while part of a mounted overlay
394filesystem are not allowed.  If the underlying filesystem is changed,
395the behavior of the overlay is undefined, though it will not result in
396a crash or deadlock.
397
398When the overlay NFS export feature is enabled, overlay filesystems
399behavior on offline changes of the underlying lower layer is different
400than the behavior when NFS export is disabled.
401
402On every copy_up, an NFS file handle of the lower inode, along with the
403UUID of the lower filesystem, are encoded and stored in an extended
404attribute "trusted.overlay.origin" on the upper inode.
405
406When the NFS export feature is enabled, a lookup of a merged directory,
407that found a lower directory at the lookup path or at the path pointed
408to by the "trusted.overlay.redirect" extended attribute, will verify
409that the found lower directory file handle and lower filesystem UUID
410match the origin file handle that was stored at copy_up time.  If a
411found lower directory does not match the stored origin, that directory
412will not be merged with the upper directory.
413
414
415
416NFS export
417----------
418
419When the underlying filesystems supports NFS export and the "nfs_export"
420feature is enabled, an overlay filesystem may be exported to NFS.
421
422With the "nfs_export" feature, on copy_up of any lower object, an index
423entry is created under the index directory.  The index entry name is the
424hexadecimal representation of the copy up origin file handle.  For a
425non-directory object, the index entry is a hard link to the upper inode.
426For a directory object, the index entry has an extended attribute
427"trusted.overlay.upper" with an encoded file handle of the upper
428directory inode.
429
430When encoding a file handle from an overlay filesystem object, the
431following rules apply:
432
4331. For a non-upper object, encode a lower file handle from lower inode
4342. For an indexed object, encode a lower file handle from copy_up origin
4353. For a pure-upper object and for an existing non-indexed upper object,
436   encode an upper file handle from upper inode
437
438The encoded overlay file handle includes:
439 - Header including path type information (e.g. lower/upper)
440 - UUID of the underlying filesystem
441 - Underlying filesystem encoding of underlying inode
442
443This encoding format is identical to the encoding format file handles that
444are stored in extended attribute "trusted.overlay.origin".
445
446When decoding an overlay file handle, the following steps are followed:
447
4481. Find underlying layer by UUID and path type information.
4492. Decode the underlying filesystem file handle to underlying dentry.
4503. For a lower file handle, lookup the handle in index directory by name.
4514. If a whiteout is found in index, return ESTALE. This represents an
452   overlay object that was deleted after its file handle was encoded.
4535. For a non-directory, instantiate a disconnected overlay dentry from the
454   decoded underlying dentry, the path type and index inode, if found.
4556. For a directory, use the connected underlying decoded dentry, path type
456   and index, to lookup a connected overlay dentry.
457
458Decoding a non-directory file handle may return a disconnected dentry.
459copy_up of that disconnected dentry will create an upper index entry with
460no upper alias.
461
462When overlay filesystem has multiple lower layers, a middle layer
463directory may have a "redirect" to lower directory.  Because middle layer
464"redirects" are not indexed, a lower file handle that was encoded from the
465"redirect" origin directory, cannot be used to find the middle or upper
466layer directory.  Similarly, a lower file handle that was encoded from a
467descendant of the "redirect" origin directory, cannot be used to
468reconstruct a connected overlay path.  To mitigate the cases of
469directories that cannot be decoded from a lower file handle, these
470directories are copied up on encode and encoded as an upper file handle.
471On an overlay filesystem with no upper layer this mitigation cannot be
472used NFS export in this setup requires turning off redirect follow (e.g.
473"redirect_dir=nofollow").
474
475The overlay filesystem does not support non-directory connectable file
476handles, so exporting with the 'subtree_check' exportfs configuration will
477cause failures to lookup files over NFS.
478
479When the NFS export feature is enabled, all directory index entries are
480verified on mount time to check that upper file handles are not stale.
481This verification may cause significant overhead in some cases.
482
483
484Testsuite
485---------
486
487There's a testsuite originally developed by David Howells and currently
488maintained by Amir Goldstein at:
489
490  https://github.com/amir73il/unionmount-testsuite.git
491
492Run as root:
493
494  # cd unionmount-testsuite
495  # ./run --ov --verify
496