参考：How containers work: overlayfs

how overlays work
Overlay filesystems, also known as “union filesystems” or “union mounts” let you mount a filesystem using 2 directories: a “lower” directory, and an “upper” directory.

Basically:

• the lower directory of the filesystem is read-only
• the upper directory of the filesystem can be both read to and written from

When a process reads a file, the overlayfs filesystem driver looks in the upper directory and reads the file from there if it’s present. Otherwise, it looks in the lower directory.

When a process writes a file, overlayfs will just write it to the upper directory.

let’s make an overlay with mount!
Combining the upper and lower directories is pretty easy: we can just do it with mount!

$ sudo mount -t overlay overlay 
    -o lowerdir=/home/bork/test/lower,upperdir=/home/bork/test/upper,workdir=/home/bork/test/work 
    /home/bork/test/merged

what happens when you create a new file?
the new file gets created in the upper directory.

what happens when you delete a file?
 

/run/kata-containers/shared/sandboxes/{$sandboxID}/mounts/

/var/lib/containerd-stargz-grpc

 overlay: lowerdir  upperdir  workdir