Container File Systems

Suppose two containers start from the same application image.

Both initially see the same /etc/api/config.yaml. If Container A modifies the file, Container B still sees the original version, and a new container started from the image does too.

The runtime does not copy the entire image for each container. Instead, it builds a layered filesystem:

Containers share the image’s read-only layers, while each container stores its own changes in a private writable layer.

A container filesystem combines shared, read-only image layers with a container-specific writable layer.

On Linux, OverlayFS is commonly used to create this layered view. It enables image sharing while keeping each container’s changes isolated.

This chapter explains image and writable layers, OverlayFS lookup, copy-up, and deletion markers, then examines volumes, mounts, root assembly, permissions, page-cache sharing, capacity, performance, and inspection.