World map

 

BM

World D6: Under the Hood

The overlay filesystem

You will learn: how many containers share one image, each writing on its own thin top layer.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Ten lunchboxes start from one alpine meal pack. How much disk do they need?

Watch

Your laptop~

  • No open hatches

Lunchboxes (containers)

  • box1running
    from alpine:3.22
  • box2running
    from alpine:3.22

Frozen packs (images)

  • alpine:3.221 layers · 12.9MB · in use

One image, two boxes, tiny extra disk. The image layers are read-only kek lapis. Each box gets a clear sheet on top. That stack is the overlay filesystem: Read-only image layers with one thin writable sheet on top for each container. Many containers share one image..

Try it

box1 wrote a note on its sheet. Can box2 read it? Type docker exec box2 cat /root/note.txt.

Your laptop~

  • No open hatches

Lunchboxes (containers)

  • box1running
    from alpine:3.22
  • box2running
    from alpine:3.22

Frozen packs (images)

  • alpine:3.221 layers · 12.9MB · in use

Predict

box1 edits /etc/profile, a file from the image. Where does the change go?

Check

bash
docker run --name box alpine:3.22 sh -c 'echo hi > /root/note.txt; rm /etc/motd; echo hi >> /etc/profile'
docker diff box
C /etc
C /etc/profile
D /etc/motd
C /root
A /root/note.txt

docker diff reads the top sheet. A = added, C = changed, D = deleted. A delete leaves a hiding sticker, called a whiteout. The image still has the file.

Check

Good habit, or needs work?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Keep database files in a volume, not on the top sheet.

You did it!

You can now explain how containers share one image.

Go deeper (optional)

In OverlayFS words: image layers are lowerdir, the sheet is upperdir, and the box sees merged. Fresh Docker Engine 29 installs use the containerd image store with its overlayfs snapshotter. Upgraded older installs may say overlay2. Check with docker info.

Real mission

  1. docker run -d --name box alpine:3.22 sleep 300
  2. docker exec box sh -c "echo hi > /root/note.txt"
  3. docker diff box
  4. docker rm -f box

0 of 4 steps done · Your ticks are saved.