OverlayFS & Casper Persistence: Live USB Linux Architecture

# Understanding OverlayFS and Casper Persistence: How Live USB Linux Retains Changes

Live Linux distributions rely on a read-only base filesystem paired with a writable overlay. This architecture ensures system integrity, rapid boot times, and effortless recovery. At the kernel level, this is powered by OverlayFS, while Casper handles the high-level orchestration for Ubuntu-based systems.

The Architecture of Live Systems

OverlayFS: The Union File System Engine

OverlayFS (v4+ in modern kernels) merges multiple directories into a single cohesive view. It operates on three critical layers:

• Lowerdir: The immutable base image (compressed squashfs).
• Upperdir: The writable overlay where user changes and system logs are staged.
• Workdir: An internal directory required for atomic operations like renames and hardlink resolution.

Linux Kernel 7.0 introduces significant performance enhancements to OverlayFS, including optimized inode caching, reduced memory overhead during fork/exec, and stricter security module (SELinux/AppArmor) integration. These improvements make overlay architectures highly suitable for ephemeral workloads and containerized environments.

You can inspect a running overlay mount using standard terminal commands:

# Identify mount points and overlay properties
mount | grep overlay
lsblk -f

# Inspect the overlay configuration
findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS /run/mnt/live-root

Casper: Bridging the Kernel to the User

Casper is the initramfs script suite that automates OverlayFS configuration. When a Live ISO boots, Casper: 1. Loads the compressed root filesystem. 2. Detects persistence media (FAT32/ext4 partitions or files). 3. Mounts the lowerdir (ISO) and upperdir (persistence). 4. Applies the overlay and hands control to systemd.

Persistence is typically managed via a dedicated partition or a casper-rw file. Ubuntu 26.04 Resolute leverages Casper's overlay driver to handle stateful sessions efficiently while maintaining strict filesystem boundaries.

# Check current persistence status and active modules
sudo casper-info
lsmod | grep overlay

# View active mount namespaces for debugging
ls -l /proc/self/ns/mnt

Practical Implementation & Terminal Workflows

Creating a persistent Live USB requires proper partitioning and filesystem alignment. Here is the recommended workflow for Ubuntu 26.04 Resolute:

# 1. Identify your USB device (WARNING: This will erase all data!)
lsblk

# 2. Create a persistent partition (ext4 is recommended for performance)
sudo mkfs.ext4 -L casper-rw /dev/sdX2

# 3. Create a symbolic link for Casper detection
cd /mnt
sudo ln -s casper-rw /live/persist

To verify persistence across reboots, simply create a test file in a writable location:

sudo touch /etc/casper-persistence-test.txt
sudo reboot
# Verify: cat /etc/casper-persistence-test.txt

Performance Tuning & Best Practices

Live USB systems often suffer from I/O bottlenecks due to USB bus limitations. Kernel 7.0's OverlayFS optimizations help, but manual tuning maximizes throughput:

1. Enable TRIM/Discard: If using an SSD USB, enable discard to prevent fragmentation and maintain write speeds.

   sudo mount -o remount,discard,noatime /live/boot

2. Optimize Workdir Location: Never place the workdir on the same physical media as the lowerdir. If possible, mount the upperdir/workdir to a RAM drive (tmpfs) for maximum speed:

   sudo mount -t tmpfs -o size=1G tmpfs /run/mnt/upper
   sudo mount -t overlay overlay -o lowerdir=/rofs,upperdir=/run/mnt/upper,workdir=/run/mnt/work /mnt

3. Adjust Inode Cache: Modern workloads generate many small files. Increase the VFS cache ratio to prevent frequent disk thrashing:

   echo 80 > /proc/sys/vfs_cache_pressure

Why This Matters for Modern Web & Linux Systems

Understanding OverlayFS and Casper is not just about Live USBs, it is foundational for modern infrastructure:

• Container Parallels: Docker, Podman, and Kubernetes rely on overlay2 storage drivers. The exact same union-mount principles apply to your microservices and container runtimes.
• Immutable Infrastructure: Web servers, CI/CD runners, and edge proxies benefit from read-only bases with isolated writable layers, preventing configuration drift and simplifying atomic rollbacks.
• Security & Forensics: Casper's separation of state from system files makes tamper-evident auditing straightforward. You can programmatically verify exactly which files were modified during a session using findmnt or diff -r.

For MooLux GNU/Linux and MooLang developers, mastering these layers provides direct insight into how our stack handles ephemeral state in cloud-native deployments. Whether you are building a live dev environment or deploying immutable web proxies, the overlay architecture remains the gold standard for stateless computing.

Conclusion

Linux Live systems retain changes through a highly optimized union of OverlayFS and Casper orchestration. Kernel 7.0 and Ubuntu 26.04 Resolute push these capabilities forward with reduced latency, enhanced security, and smarter I/O scheduling. By mastering these tools, you gain deeper control over ephemeral environments, container storage drivers, and secure, reproducible deployments.