github.com/SagerNet/gvisor@v0.0.0-20210707092255-7731c139d75c/g3doc/user_guide/filesystem.md (about)

     1  # Filesystem
     2  
     3  [TOC]
     4  
     5  gVisor accesses the filesystem through a file proxy, called the Gofer. The gofer
     6  runs as a separate process, that is isolated from the sandbox. Gofer instances
     7  communicate with their respective sentry using the 9P protocol. For another
     8  explanation see [What is gVisor?](../README.md).
     9  
    10  ## Sandbox overlay
    11  
    12  To isolate the host filesystem from the sandbox, you can set a writable tmpfs
    13  overlay on top of the entire filesystem. All modifications are made to the
    14  overlay, keeping the host filesystem unmodified.
    15  
    16  > Note: All created and modified files are stored in memory inside the sandbox.
    17  
    18  To use the tmpfs overlay, add the following `runtimeArgs` to your Docker
    19  configuration (`/etc/docker/daemon.json`) and restart the Docker daemon:
    20  
    21  ```json
    22  {
    23      "runtimes": {
    24          "runsc": {
    25              "path": "/usr/local/bin/runsc",
    26              "runtimeArgs": [
    27                  "--overlay"
    28              ]
    29         }
    30      }
    31  }
    32  ```
    33  
    34  ## Shared root filesystem
    35  
    36  The root filesystem is where the image is extracted and is not generally
    37  modified from outside the sandbox. This allows for some optimizations, like
    38  skipping checks to determine if a directory has changed since the last time it
    39  was cached, thus missing updates that may have happened. If you need to `docker
    40  cp` files inside the root filesystem, you may want to enable shared mode. Just
    41  be aware that file system access will be slower due to the extra checks that are
    42  required.
    43  
    44  > Note: External mounts are always shared.
    45  
    46  To use set the root filesystem shared, add the following `runtimeArgs` to your
    47  Docker configuration (`/etc/docker/daemon.json`) and restart the Docker daemon:
    48  
    49  ```json
    50  {
    51      "runtimes": {
    52          "runsc": {
    53              "path": "/usr/local/bin/runsc",
    54              "runtimeArgs": [
    55                  "--file-access=shared"
    56              ]
    57         }
    58      }
    59  }
    60  ```