|
1 | 1 | .nh |
2 | | -.TH fuse-overlayfs 1 "User Commands" |
| 2 | +.TH fuse\-overlayfs 1 "User Commands" |
3 | 3 |
|
4 | 4 | .SH NAME |
5 | 5 | .PP |
6 | | -fuse-overlayfs - overlayfs FUSE implementation |
| 6 | +fuse\-overlayfs \- combine directory trees in userspace |
7 | 7 |
|
8 | 8 |
|
9 | 9 | .SH SYNOPSIS |
10 | | -.PP |
| 10 | +.TP |
11 | 11 | mounting |
12 | | - fuse-overlayfs [\-f] [\-\-debug] [\-o OPTS] MOUNT_TARGET |
| 12 | +\fBfuse\-overlayfs\fP [\fB\-f\fP] [\fB\-d\fP] [\fB\-o\fP \fIOPTION\fP[,\fIOPTION2\fP, ...]] \fImountpoint\fP |
13 | 13 |
|
14 | | -.PP |
| 14 | +.TP |
15 | 15 | unmounting |
16 | | - fusermount \-u mountpoint |
| 16 | +\fBfusermount \-u\fP \fImountpoint\fP |
17 | 17 |
|
18 | 18 |
|
19 | 19 | .SH DESCRIPTION |
20 | 20 | .PP |
21 | | -fuse-overlayfs provides an overlayfs FUSE implementation so that it |
22 | | -can be used since Linux 4.18 by unprivileged users in an user |
23 | | -namespace. |
| 21 | +\fBfuse\-overlayfs\fP combines (overlays) two or more directory trees into one. It |
| 22 | +can be used by unprivileged users in an user namespace. It is built with FUSE |
| 23 | +and works with Linux 4.18 or newer. |
24 | 24 |
|
25 | 25 |
|
26 | 26 | .SH OPTIONS |
27 | | -.PP |
28 | | -\fB\-\-debug\fP |
| 27 | +.TP |
| 28 | +\fB\-f\fP |
| 29 | +Run in foreground. |
| 30 | + |
| 31 | +.TP |
| 32 | +\fB\-d\fP, \fB\-\-debug\fP, \fB\-o debug\fP |
29 | 33 | Enable debugging mode, can be very noisy. |
30 | 34 |
|
31 | | -.PP |
32 | | -\fB\-o lowerdir=low1[:low2...]\fP |
| 35 | +.TP |
| 36 | +\fB\-o lowerdir\fP=\fIlow1\fP[\fI:low2...\fP] |
33 | 37 | A list of directories separated by \fB\fC:\fR\&. Their content is merged. |
34 | 38 |
|
35 | | -.PP |
36 | | -\fB\-o upperdir=upperdir\fP |
37 | | -A directory merged on top of all the lowerdirs where all the changes |
38 | | -done to the file system will be written. |
| 39 | +.TP |
| 40 | +\fB\-o upperdir\fP=\fIupperdir\fP |
| 41 | +A directory merged on top of all the lowerdirs where all the changes done |
| 42 | +to the file system will be written. |
39 | 43 |
|
40 | | -.PP |
41 | | -\fB\-o workdir=workdir\fP |
42 | | -A directory used internally by fuse-overlays, must be on the same file |
43 | | -system as the upper dir. |
| 44 | +.TP |
| 45 | +\fB\-o workdir\fP=\fIworkdir\fP |
| 46 | +A directory used internally by fuse\-overlays, must be on the same file |
| 47 | +system as the upperdir. |
44 | 48 |
|
45 | 49 | .PP |
46 | | -\fB\-o uidmapping=UID:MAPPED-UID:LEN[,UID2:MAPPED-UID2:LEN2]\fP |
47 | | -\fB\-o gidmapping=GID:MAPPED-GID:LEN[,GID2:MAPPED-GID2:LEN2]\fP |
48 | | -Specifies the dynamic UID/GID mapping used by fuse-overlayfs when |
| 50 | +\fB\-o uidmapping\fP=\fIUID:MAPPED\-UID:LEN\fP[\fI,UID2:MAPPED\-UID2:LEN2\fP] |
| 51 | + |
| 52 | +.TP |
| 53 | +\fB\-o gidmapping\fP=\fIGID:MAPPED\-GID:LEN\fP[\fI,GID2:MAPPED\-GID2:LEN2\fP] |
| 54 | +Specify the dynamic UID/GID mapping used by fuse\-overlayfs when |
49 | 55 | reading/writing files to the system. |
50 | 56 |
|
51 | | -.PP |
52 | | -The fuse-overlayfs dynamic mapping is an alternative and cheaper way |
53 | | -to chown'ing the files on the host to accommodate the user namespace |
54 | | -settings. |
| 57 | +.TP |
| 58 | +\fB\-o squash\_to\_root\fP |
| 59 | +Make every file and directory owned by the root user (0:0). |
55 | 60 |
|
56 | 61 | .PP |
57 | | -It is useful to share the same storage among different user namespaces |
58 | | -and counter effect the mapping done by the user namespace itself, and |
59 | | -without requiring to chown the files. |
| 62 | +\fB\-o squash\_to\_uid\fP=\fIuid\fP |
60 | 63 |
|
61 | | -.PP |
62 | | -For example, given on the host two files like: |
| 64 | +.TP |
| 65 | +\fB\-o squash\_to\_gid\fP=\fIgid\fP |
| 66 | +Make every file and directory owned by the specified uid or gid. It has |
| 67 | +higher precedence over \fBsquash\_to\_root\fP\&. |
63 | 68 |
|
64 | | -.PP |
65 | | -$ stat \-c %u:%g lower/a lower/b |
66 | | -0:0 |
67 | | -1:1 |
| 69 | +.TP |
| 70 | +\fB\-o static\_nlink\fP |
| 71 | +Set \fB\fCst\_nlink\fR to the static value 1 for all directories. This can be |
| 72 | +useful for higher latency file systems such as NFS, where counting the number |
| 73 | +of hard links for a directory with many files can be a slow operation. With |
| 74 | +this option enabled, the number of hard links reported when running stat for |
| 75 | +any directory is 1. |
68 | 76 |
|
69 | | -.PP |
70 | | -When we run in a user namespace with the following configuration: |
71 | | -$ cat /proc/self/uid_map |
72 | | - 0 1000 1 |
73 | | - 1 110000 65536 |
| 77 | +.TP |
| 78 | +\fB\-o noacl\fP |
| 79 | +Disable ACL support in the FUSE file system. |
| 80 | + |
| 81 | +.TP |
| 82 | +\fB\-o xino\fP=\fBoff\fP|\fBauto\fP|\fBon\fP |
| 83 | +Controls how \fB\fCst\_ino\fR values are generated for files returned by |
| 84 | +fuse\-overlayfs. When all lower and upper layers reside on the same underlying |
| 85 | +device, fuse\-overlayfs exposes the real inode number from the underlying |
| 86 | +filesystem. When layers span multiple devices, an opaque inode number is |
| 87 | +generated; by default this value is not stable across mounts. |
74 | 88 |
|
75 | 89 | .PP |
76 | | -We would see: |
| 90 | +The \fB\fCxino\fR option modifies this behavior: |
| 91 | + |
| 92 | +.TP |
| 93 | +\fBxino\fP=\fBoff\fP |
| 94 | +Disables extended inode generation. This matches the default behavior: when |
| 95 | +all layers are on the same device, the underlying inode number is used; |
| 96 | +otherwise an opaque, non‑stable inode number is returned. |
| 97 | + |
| 98 | +.TP |
| 99 | +\fBxino\fP=\fBauto\fP |
| 100 | +Attempts to generate stable inode numbers across mounts by hashing the file |
| 101 | +handle returned by \fB\fCname\_to\_handle\_at(2)\fR\&. This mode is used only if all layers |
| 102 | +support \fB\fCname\_to\_handle\_at(2)\fR; if any layer does not, behavior falls back to |
| 103 | +\fB\fCxino=off\fR\&. If all layers are on the same device, the underlying inode number |
| 104 | +is still used, regardless of this setting. |
| 105 | + |
| 106 | +.TP |
| 107 | +\fBxino\fP=\fBon\fP |
| 108 | +Requires that all layers support \fB\fCname\_to\_handle\_at(2)\fR\&. If they do, inode |
| 109 | +numbers are derived from a hash of the file handle and remain stable across |
| 110 | +mounts. If any layer does not support \fB\fCname\_to\_handle\_at(2)\fR, the mount fails. |
| 111 | +As with other modes, when all layers are on the same device, the underlying |
| 112 | +inode number always takes precedence. |
| 113 | + |
| 114 | +.TP |
| 115 | +\fB\-o ino32\_t\fP |
| 116 | +Forces all returned \fB\fCst\_ino\fR values to be truncated to 32 bits. This option |
| 117 | +exists solely for compatibility with older 32‑bit userspaces that cannot |
| 118 | +correctly handle 64‑bit inode numbers. It has no functional benefit on modern |
| 119 | +systems and should not be used unless required for legacy compatibility. |
| 120 | + |
| 121 | +.TP |
| 122 | +\fB\-h\fP, \fB\-\-help\fP |
| 123 | +Show additional options, provided by FUSE. |
| 124 | + |
| 125 | +.TP |
| 126 | +\fB\-V\fP, \fB\-\-version\fP |
| 127 | +Show versions of fuse\-overlayfs and FUSE. |
| 128 | + |
77 | 129 |
|
| 130 | +.SH DYNAMIC UID AND GID MAPPING |
78 | 131 | .PP |
79 | | -$ stat \-c %u:%g merged/a merged/b |
80 | | -65534:65534 |
81 | | -65534:65534 |
| 132 | +The fuse\-overlayfs dynamic mapping is an alternative and cheaper way to |
| 133 | +chown'ing the files on the host to accommodate the user namespace settings. |
82 | 134 |
|
83 | 135 | .PP |
84 | | -65534 is the overflow id used when the UID/GID is not known inside the |
85 | | -user namespace. This happens because both users 0:0 and 1:1 are not |
86 | | -mapped. |
| 136 | +It is useful to share the same storage among different user namespaces and |
| 137 | +counter effect the mapping done by the user namespace itself, and without |
| 138 | +requiring to chown the files. |
87 | 139 |
|
88 | 140 | .PP |
89 | | -In the above example, if we mount the fuse-overlayfs file system using: |
90 | | -\fB\fC\-ouidmapping=0:1000:1:1:110000:65536,gidmapping=0:1000:1:1:110000:65536\fR, |
91 | | -which is the namespace configuration specified on a single line, we'd |
92 | | -see from the same user namespace: |
| 141 | +Take, for example, two files with the following user and group IDs: |
93 | 142 |
|
94 | 143 | .PP |
95 | | -$ stat \-c %u:%g merged/a merged/b |
| 144 | +.RS |
| 145 | + |
| 146 | +.nf |
| 147 | +$ stat \-c %u:%g lower/a lower/b |
96 | 148 | 0:0 |
97 | 149 | 1:1 |
98 | 150 |
|
99 | | -.PP |
100 | | -Those are the same IDs visible from outside the user namespace. |
| 151 | +.fi |
| 152 | +.RE |
101 | 153 |
|
102 | 154 | .PP |
103 | | -\fB\-o squash_to_root\fP |
104 | | -Every file and directory is owned by the root user (0:0). |
| 155 | +Also take note of the following user namespace configuration: |
105 | 156 |
|
106 | 157 | .PP |
107 | | -\fB\-o squash_to_uid=uid\fP |
108 | | -\fB\-o squash_to_gid=gid\fP |
109 | | -Every file and directory is owned by the specified uid or gid. |
| 158 | +.RS |
| 159 | + |
| 160 | +.nf |
| 161 | +$ cat /proc/self/uid\_map |
| 162 | + 0 1000 1 |
| 163 | + 1 110000 65536 |
| 164 | + |
| 165 | +.fi |
| 166 | +.RE |
110 | 167 |
|
111 | 168 | .PP |
112 | | -It has higher precedence over \fBsquash_to_root\fP\&. |
| 169 | +After mounting with fuse\-overlayfs, the ownership would change: |
113 | 170 |
|
114 | 171 | .PP |
115 | | -\fB\-o static_nlink\fP |
116 | | -Set st_nlink to the static value 1 for all directories. |
| 172 | +.RS |
| 173 | + |
| 174 | +.nf |
| 175 | +$ stat \-c %u:%g merged/a merged/b |
| 176 | +65534:65534 |
| 177 | +65534:65534 |
| 178 | + |
| 179 | +.fi |
| 180 | +.RE |
117 | 181 |
|
118 | 182 | .PP |
119 | | -This can be useful for higher latency file systems such as NFS, where |
120 | | -counting the number of hard links for a directory with many files can |
121 | | -be a slow operation. With this option enabled, the number of hard |
122 | | -links reported when running stat for any directory is 1. |
| 183 | +65534 is the overflow ID used when the UID/GID is not known inside the user |
| 184 | +namespace. This happens because neither user IDs 0 nor 1 are mapped. |
123 | 185 |
|
124 | 186 | .PP |
125 | | -\fB\-o noacl\fP |
126 | | -Disable ACL support in the FUSE file system. |
| 187 | +To map them, we'd mount the fuse\-overlayfs file system using the following |
| 188 | +namespace configuration: |
127 | 189 |
|
128 | 190 | .PP |
129 | | -\fB\-o xino=off|auto|on\fP |
130 | | -Controls how \fIst_ino\fP values are generated for files exposed by fuse-overlayfs. |
| 191 | +.RS |
131 | 192 |
|
132 | | -When all lower and upper layers reside on the same underlying device, |
133 | | -fuse-overlayfs exposes the real inode number from the underlying filesystem. |
134 | | -When layers span multiple devices, an opaque inode number is generated; by |
135 | | -default this value is not stable across mounts. |
| 193 | +.nf |
| 194 | +\-o uidmapping=0:1000:1:1:110000:65536,gidmapping=0:1000:1:1:110000:65536 |
136 | 195 |
|
137 | | -The \fBxino\fP option modifies this behavior: |
| 196 | +.fi |
| 197 | +.RE |
138 | 198 |
|
139 | 199 | .PP |
140 | | -\fB\-o xino=off\fP |
141 | | -Disables extended inode generation. This matches the default behavior: |
142 | | -when all layers are on the same device, the underlying inode number is used; |
143 | | -otherwise an opaque, non‑stable inode number is returned. |
| 200 | +The result would then be the following: |
144 | 201 |
|
145 | 202 | .PP |
146 | | -\fB\-o xino=auto\fP |
147 | | -Attempts to generate stable inode numbers across mounts by hashing the file |
148 | | -handle returned by \fIname_to_handle_at\fP(2). |
149 | | -This mode is used only if all layers support \fIname_to_handle_at\fP(2); if any |
150 | | -layer does not, behavior falls back to \fBxino=off\fP. |
151 | | -If all layers are on the same device, the underlying inode number is still |
152 | | -used, regardless of this setting. |
| 203 | +.RS |
153 | 204 |
|
154 | | -.PP |
155 | | -\fB\-o xino=on\fP |
156 | | -Requires that all layers support \fIname_to_handle_at\fP(2). If they do, inode |
157 | | -numbers are derived from a hash of the file handle and remain stable across |
158 | | -mounts. |
159 | | -If any layer does not support \fIname_to_handle_at\fP(2), the mount fails. |
160 | | -As with other modes, when all layers are on the same device, the underlying |
161 | | -inode number always takes precedence. |
| 205 | +.nf |
| 206 | +$ stat \-c %u:%g merged/a merged/b |
| 207 | +0:0 |
| 208 | +1:1 |
| 209 | + |
| 210 | +.fi |
| 211 | +.RE |
162 | 212 |
|
163 | 213 | .PP |
164 | | -\fB\-o ino32_t\fP |
165 | | -Forces all returned \fIst_ino\fP values to be truncated to 32 bits. |
| 214 | +Those are the same IDs visible from outside the user namespace. |
166 | 215 |
|
167 | | -This option exists solely for compatibility with older 32‑bit userspaces that |
168 | | -cannot correctly handle 64‑bit inode numbers. It has no functional benefit on |
169 | | -modern systems and should not be used unless required for legacy compatibility. |
170 | 216 |
|
171 | 217 | .SH SEE ALSO |
172 | 218 | .PP |
173 | | -\fBfuse\fP(8), \fBmount\fP(8), \fBuser_namespaces\fP(7) |
| 219 | +\fBfuse\fP(8), \fBmount\fP(8), \fBuser\_namespaces\fP(7) |
174 | 220 |
|
175 | 221 |
|
176 | 222 | .SH AVAILABILITY |
177 | 223 | .PP |
178 | | -The fuse-overlayfs command is available from |
179 | | -\fBhttps://github.com/containers/fuse-overlayfs\fP under GNU GENERAL PUBLIC LICENSE Version 3 or later. |
| 224 | +The fuse\-overlayfs command is available from |
| 225 | +\fBhttps://github.com/containers/fuse\-overlayfs\fP under GNU GENERAL PUBLIC |
| 226 | +LICENSE Version 3 or later. |
0 commit comments