3

I have a linux with a read only root filesystem and a read-write overlayfs mounted over it:

# mount overlayfs on / type overlayfs (rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/) ...

The overlayfs is almost full

# df Filesystem 1K-blocks Used Available Use% Mounted on overlayfs 4003548 3995012 8536 99% / ...

How can I identify files consuming the read/write part of the overlayfs? The du does not differentiate space occupied on ro and rw media. I have found the option -fstype type in find but my linux has busybox and the find does not support this option there.

EDIT: add output from cat /proc/mounts

rootfs / rootfs rw 0 0 proc /proc proc rw,relatime 0 0 sysfs /sys sysfs rw,relatime 0 0 none /dev devtmpfs rw,relatime,size=1026976,nr_inodes=256744,mode=755 0 0 /dev/sda1 /root_rw ext4 rw,relatime,errors=remount-ro,data=ordered 0 0 ubi0:rootfs /root_ro ubifs ro,noatime,nodiratime 0 0 overlayfs / overlayfs rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/ 0 0 debugfs /sys/kernel/debug debugfs rw,relatime 0 0 devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
Improve this question

2 Answers 2

Reset to default
2

There isn't really a notion of “what occupies the space” in an overlay filesystem. Each branch of the union has its own space occupation. Run du on both branches. If it's getting more full, the read-write branch is the culprit.

Since the overlay mount shadows its branches (/root_ro and /root_rw are hidden by the mount on /), you need to gain access to the branches. You can do that by mounting the block device again (Linux supports this, at least for most block device types):

mkdir /media/root_ro /media/root_rw mount /dev/sda1 /mnt/root_rw mount ubi0:rootfs /mnt/root_ro du /mnt/root_ro /mnt/root_rw
Improve this answer
4
  • I do not see /root_ro and /root_rw in the filesystem. I am not an overlayfs expert but I guess /root_ro and /root_rw are available only during an early boot stage and then system does "a magic" and these directories are not visible anymore. Commented Apr 20, 2016 at 8:04
  • @ZabojCampula Oh, yeah, sorry, the filesystem is mounted on /. You can still access the branches through a bind mount in a different location. They might be mounted somewhere already. Check the output of cat /proc/mounts — if you don't understand how to find it, add this output to your question. Commented Apr 20, 2016 at 10:33
  • It is not mounted I think. Nevertheless I put the /proc/mounts to the question. Commented Apr 20, 2016 at 15:53
  • @ZabojCampula Hmm, right, so the mount on / shadows the mount points. There's a solution in your case (see my edit) but I don't know if there's a general solution. Commented Apr 20, 2016 at 17:23
1

Unmount the overlay filesystem, and then mount it somewhere else and check it using du. If I understand them correctly, that should let you see what's in it.

Improve this answer
1
  • 1
    +1 because looks a good idea and it should help. But not acceptable answer for me because I want to do that on running system - no umount possible. Commented Apr 18, 2016 at 14:51

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.