VFS & OverlayFS

Linux VFS abstraction, mount namespaces, bind mounts, OverlayFS layering for container images, and copy-on-write semantics.

Overview

Overview The Virtual File System (VFS) is a kernel abstraction layer that provides a uniform file API (open, read, write, stat) across all filesystem types — ext4, XFS, NFS, procfs, tmpfs, and more. Every file operation passes through VFS before reaching the concrete filesystem driver.

VFS Key Concepts

Superblock — filesystem-wide metadata (block size, inode count)
Inode — file metadata (permissions, size, timestamps, block pointers) — no filename
Dentry — directory entry that maps a filename to an inode; cached in the dentry cache
File object — open file descriptor state (offset, flags)

Mount Namespaces

Mount namespaces isolate the filesystem tree. Each container gets its own mount namespace — changes to mounts inside are invisible outside. Created with clone(CLONE_NEWNS) or unshare --mount.

Bind Mounts

Bind mounts re-expose a directory at a second path:

Docker -v /host/path:/container/path is a bind mount propagated into the container mount namespace.

OverlayFS — Container Image Layers

OverlayFS stacks multiple directory trees into a unified view:

lowerdir — read-only base layers (Docker image layers, bottom to top separated by colons)
upperdir — read-write container layer (container writes go here)
workdir — internal kernel workspace (must be on same filesystem as upperdir)
merged — the unified view shown to the container process

Copy-on-write: Reading a file from lowerdir is zero-copy. Writing a lower-layer file copies it to upperdir first (copy-up), then modifies it — the lower layer is unchanged.

Deletion: A deleted lower-layer file creates a whiteout file in upperdir (char device 0,0) that masks the lower entry.

Key concepts

Copy-up: When a container writes to a file that exists only in a lower (image) layer, OverlayFS copies the entire file to upperdir first, then applies the write. First write is expensive; subsequent writes are fast.
Whiteout: A special character device (0,0) created in upperdir to mask a deleted file in lowerdir. The merged view hides the lower file.
Mount namespace: A per-process isolation of the filesystem tree. Containers use separate mount namespaces so their mounts do not affect the host.
Dentry cache: Kernel cache of directory entries (name → inode mappings). High dentry cache usage indicates many small file operations or a large directory tree.

When to use it

Explaining how Docker image layers work and why containers share base layers efficiently
Debugging "no space left on device" inside a container when the overlay upperdir is full
Designing efficient CI build caches using overlayfs layer reuse

Interview questions

How does Docker use OverlayFS to share base image layers between containers, and what happens when a container writes to a file?