AUFS: Image Layers, Container Layers, and Read/Write Operations

view of all layers. The directory names do not directly correspond to the IDs of the layers themselves. AUFS uses the Copy-on-Write (CoW) strategy to maximize storage efficiency and minimize overhead. ### Example: Image and container on-disk constructs The following `docker pull` command shows a Docker host downloading a Docker image comprising five layers. ```console $ docker pull ubuntu Using default tag: latest latest: Pulling from library/ubuntu b6f892c0043b: Pull complete 55010f332b04: Pull complete 2955fb827c94: Pull complete 3deef3fcbd30: Pull complete cf9722e506aa: Pull complete Digest: sha256:382452f82a8bbd34443b2c727650af46aced0f94a44463c62a9848133ecb1aa8 Status: Downloaded newer image for ubuntu:latest ``` #### The image layers > `/var/lib/docker/`. These files and directories are managed by Docker. All of the information about the image and container layers is stored in subdirectories of `/var/lib/docker/aufs/`. - `diff/`: the **contents** of each layer, each stored in a separate subdirectory - `layers/`: metadata about how image layers are stacked. This directory contains one file for each image or container layer on the Docker host. Each file contains the IDs of all the layers below it in the stack (its parents). - `mnt/`: Mount points, one per image or container layer, which are used to assemble and mount the unified filesystem for a container. For images, which are read-only, these directories are always empty. #### The container layer If a container is running, the contents of `/var/lib/docker/aufs/` change in the following ways: - `diff/`: Differences introduced in the writable container layer, such as new or modified files. - `layers/`: Metadata about the writable container layer's parent layers. - `mnt/`: A mount point for each running container's unified filesystem, exactly as it appears from within the container. ## How container reads and writes work with `aufs` ### Reading files Consider three scenarios where a container opens a file for read access with aufs. - **The file does not exist in the container layer**: If a container opens a file for read access and the file does not already exist in the container layer, the storage driver searches for the file in the image layers, starting with the layer just below the container layer. It is read from the layer where it is found. - **The file only exists in the container layer**: If a container opens a file for read access and the file exists in the container layer, it is read from there. - **The file exists in both the container layer and the image layer**: If a container opens a file for read access and the file exists in the container layer and one or more image layers, the file is read from the container layer. Files in the container layer obscure files with the same name in the image layers. ### Modifying files or directories Consider some scenarios where files in a container are modified. - **Writing to a file for the first time**: The first time a container writes to an existing file, that file does not exist in the container (`upperdir`). The `aufs` driver performs a *copy_up* operation to copy the file from the image layer where it exists to the writable container layer. The container then writes the changes to the new copy of the file in the container layer.

The AUFS storage driver stores image and container layer information in `/var/lib/docker/aufs/` including `diff/` (layer contents), `layers/` (layer stacking metadata), and `mnt/` (mount points). When a container reads a file, AUFS searches layers sequentially. Modifying a file for the first time triggers a `copy_up` operation, copying the file to the container layer before writing changes.