I have a linux with a read only root filesystem and a read-write overlayfs mounted over it:

# mount
overlayfs on / type overlayfs (rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/)

The overlayfs is almost full

# df
Filesystem           1K-blocks      Used Available Use% Mounted on
overlayfs              4003548   3995012      8536  99% /

How can I identify files consuming the read/write part of the overlayfs? The du does not differentiate space occupied on ro and rw media. I have found the option -fstype type in find but my linux has busybox and the find does not support this option there.

EDIT: add output from cat /proc/mounts

rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /dev devtmpfs rw,relatime,size=1026976,nr_inodes=256744,mode=755 0 0
/dev/sda1 /root_rw ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
ubi0:rootfs /root_ro ubifs ro,noatime,nodiratime 0 0
overlayfs / overlayfs rw,relatime,lowerdir=/root_ro/,upperdir=/root_rw/ 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0

There isn't really a notion of “what occupies the space” in an overlay filesystem. Each branch of the union has its own space occupation. Run du on both branches. If it's getting more full, the read-write branch is the culprit.

Since the overlay mount shadows its branches (/root_ro and /root_rw are hidden by the mount on /), you need to gain access to the branches. You can do that by mounting the block device again (Linux supports this, at least for most block device types):

mkdir /media/root_ro /media/root_rw
mount /dev/sda1 /mnt/root_rw
mount ubi0:rootfs /mnt/root_ro
du /mnt/root_ro /mnt/root_rw
| improve this answer | |
  • I do not see /root_ro and /root_rw in the filesystem. I am not an overlayfs expert but I guess /root_ro and /root_rw are available only during an early boot stage and then system does "a magic" and these directories are not visible anymore. – Zaboj Campula Apr 20 '16 at 8:04
  • @ZabojCampula Oh, yeah, sorry, the filesystem is mounted on /. You can still access the branches through a bind mount in a different location. They might be mounted somewhere already. Check the output of cat /proc/mounts — if you don't understand how to find it, add this output to your question. – Gilles 'SO- stop being evil' Apr 20 '16 at 10:33
  • It is not mounted I think. Nevertheless I put the /proc/mounts to the question. – Zaboj Campula Apr 20 '16 at 15:53
  • @ZabojCampula Hmm, right, so the mount on / shadows the mount points. There's a solution in your case (see my edit) but I don't know if there's a general solution. – Gilles 'SO- stop being evil' Apr 20 '16 at 17:23

Unmount the overlay filesystem, and then mount it somewhere else and check it using du. If I understand them correctly, that should let you see what's in it.

| improve this answer | |
  • +1 because looks a good idea and it should help. But not acceptable answer for me because I want to do that on running system - no umount possible. – Zaboj Campula Apr 18 '16 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.