I have a linux with a read only root filesystem and a read-write overlayfs mounted over it:

# mount
overlayfs on / type overlayfs (rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/)

The overlayfs is almost full

# df
Filesystem           1K-blocks      Used Available Use% Mounted on
overlayfs              4003548   3995012      8536  99% /

How can I identify files consuming the read/write part of the overlayfs? The du does not differentiate space occupied on ro and rw media. I have found the option -fstype type in find but my linux has busybox and the find does not support this option there.

EDIT: add output from cat /proc/mounts

rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /dev devtmpfs rw,relatime,size=1026976,nr_inodes=256744,mode=755 0 0
/dev/sda1 /root_rw ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
ubi0:rootfs /root_ro ubifs ro,noatime,nodiratime 0 0
overlayfs / overlayfs rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/ 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0

2 Answers 2


There isn't really a notion of “what occupies the space” in an overlay filesystem. Each branch of the union has its own space occupation. Run du on both branches. If it's getting more full, the read-write branch is the culprit.

Since the overlay mount shadows its branches (/root_ro and /root_rw are hidden by the mount on /), you need to gain access to the branches. You can do that by mounting the block device again (Linux supports this, at least for most block device types):

mkdir /media/root_ro /media/root_rw
mount /dev/sda1 /mnt/root_rw
mount ubi0:rootfs /mnt/root_ro
du /mnt/root_ro /mnt/root_rw
  • I do not see /root_ro and /root_rw in the filesystem. I am not an overlayfs expert but I guess /root_ro and /root_rw are available only during an early boot stage and then system does "a magic" and these directories are not visible anymore. Apr 20, 2016 at 8:04
  • @ZabojCampula Oh, yeah, sorry, the filesystem is mounted on /. You can still access the branches through a bind mount in a different location. They might be mounted somewhere already. Check the output of cat /proc/mounts — if you don't understand how to find it, add this output to your question. Apr 20, 2016 at 10:33
  • It is not mounted I think. Nevertheless I put the /proc/mounts to the question. Apr 20, 2016 at 15:53
  • @ZabojCampula Hmm, right, so the mount on / shadows the mount points. There's a solution in your case (see my edit) but I don't know if there's a general solution. Apr 20, 2016 at 17:23

Unmount the overlay filesystem, and then mount it somewhere else and check it using du. If I understand them correctly, that should let you see what's in it.

  • +1 because looks a good idea and it should help. But not acceptable answer for me because I want to do that on running system - no umount possible. Apr 18, 2016 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .