Debian forky OverlayFS BTRFS/XFS setup

Combining OverlayFS with a Btrfs layout on Debian Forky unlocks powerful advantages that Btrfs subvolumes and snapshots cannot achieve alone. While Btrfs handles structural versioning, snapshots, and data safety at the block/filesystem level, OverlayFS operates at the VFS layer to handle dynamic, temporary, or isolated runtime modifications. 

One more option provided is recovery main instance via booting into Overlay instance using Grub Submenu. By explicitly mounting the top-level Btrfs volume (subvolid=5) into a temporary directory like /mnt, you step outside the overlay's jurisdiction. This allows the kernel to recognize the true Btrfs layout and perform instant atomic subvolume swaps.
sudo mount -o subvolid=5   /dev/vda4   /mnt
sudo btrfs subvolume list   /mnt/@
sudo mv   /mnt/@   /mnt/@_broken
sudo btrfs subvolume   snapshot    /mnt/@snapshots/required-ID/snapshot      /mnt/@
sudo btrfs subvolume   delete   /mnt/@_broken 

Final instance btrfs/xfs  layout
boris@Debian1510:~$ hostnamectl
 Static hostname: Debian1510
       Icon name: computer-vm
         Chassis: vm 💽
      Machine ID: edf88060aa784d0f9b7f14b3c6d1a8c1
         Boot ID: e2264038aeb4455f99e854dab9d16b17
  Virtualization: kvm
Operating System: Debian GNU/Linux forky/sid
          Kernel: Linux 7.2.9+deb14-amd64
    Architecture: x86-64
 Hardware Vendor: QEMU
  Hardware Model: Standard PC _Q35 + ICH9, 2009_
Hardware Version: pc-q35-11.1
Firmware Version: edk2-20260812-9.fc45
   Firmware Date: Wed 2026-08-12
    Firmware Age: 2month 3d

boris@Debian1510:~$ findmnt -t btrfs
TARGET        SOURCE                 FSTYPE OPTIONS
/             /dev/vda4[/@]          btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=257,subvol=/@
├─/.snapshots /dev/vda4[/@snapshots] btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=258,subvol=/@snapshots
├─/home       /dev/vda4[/@home]      btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=259,subvol=/@home
├─/var/cache  /dev/vda4[/@cache]     btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=260,subvol=/@cache
└─/var/log    /dev/vda4[/@log]       btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=261,subvol=/@log
boris@Debian1510:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1 vfat   FAT32       D643-B66B                              68.2M    12% /boot/efi
├─vda2 ext4   1.0         c8860b5b-e657-4ff2-acdb-e2a08947a7b5    1.6G     3% /boot
├─vda3 xfs                41565303-cab9-4cb6-9f9c-5ec5d8acbc0e   42.9G     2% /opt
└─vda4 btrfs              75028dc8-40ef-4c97-8944-d8850c1ee107   42.8G    13% /var/log
                                                                              /var/cache
                                                                              /home
                                                                              /.snapshots
                                                                              /
 

###################################################
On clean Debian forky KVM Guest proceed as follows
###################################################
sudo apt install inotify-tools gawk git build-essential snapper -y

1.Switch @rootfs to @ ( standard names convention)

mkdir -p /mnt/btrfs_root
mount -o subvolid=5 /dev/vda4 /mnt/btrfs_root
mkdir -p /mnt/btrfs_root/btrfs_base
btrfs subvolume snapshot /mnt/btrfs_root/@rootfs  /mnt/btrfs_root/btrfs_base/@
mv /mnt/btrfs_root/btrfs_base/@  /mnt/btrfs_root/@
rmdir /mnt/btrfs_root/btrfs_base
umount /mnt/btrfs_root
mkdir -p /mnt/system-root
mount -o subvol=@ /dev/vda4 /mnt/system-root
mount /dev/vda2 /mnt/system-root/boot
mount /dev/vda1 /mnt/system-root/boot/efi
for i in /dev /dev/pts /proc /sys /run; do mount -B $i /mnt/system-root$i; done
##########
Next step
##########
chroot /mnt/system-root /bin/bash
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=debian --recheck
grub-install --target=x86_64-efi --efi-directory=/boot/efi --removable
update-initramfs -u -k all
update-grub
exit
#########################
Upon exiting from chroot
#########################
for i in /run /sys /proc /dev/pts /dev; do umount /mnt/system-root$i; done
umount /mnt/system-root/boot/efi
umount /mnt/system-root/boot
sed -i 's/rootflags=subvol=@rootfs/rootflags=subvol=@/g' /boot/grub/grub.cfg

#############################################
Update /mnt/system-root/etc/fstab as follows
#############################################
Remove old entry and replace with
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 / btrfs   defaults,subvol=@,compress=zstd,noatime   0       1
:wq
########
systemctl daemon-reload
mount -a
##########
System reboot

#######################################################
Log into instance back and create subvolumes per standard schema
#######################################################
findmnt -t btrfs
update-grub
mkdir -p /mnt/btrfs_base
mount -o subvolid=5 /dev/vda4 /mnt/btrfs_base
btrfs subvolume create /mnt/btrfs_base/@snapshots
btrfs subvolume create /mnt/btrfs_base/@home
btrfs subvolume create /mnt/btrfs_base/@cache
btrfs subvolume create /mnt/btrfs_base/@log
###########
Next step
###########
snapper -c root create-config /
btrfs subvolume delete /.snapshots
mkdir /.snapshots
##########################
Backup user's home folder
##########################
tar -czf boris.tar.gz boris
cp boris.tar.gz  /tmp
btrfs subvolume list /

###############################
Update /etc/fstab as follows
###############################
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 /              btrfs   defaults,subvol=@,compress=zstd,noatime   0       1
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 /home          btrfs   defaults,subvol=@home,compress=zstd,noatime   0       1
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 /var/cache     btrfs   defaults,subvol=@cache,compress=zstd,noatime   0       1
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 /var/log       btrfs   defaults,subvol=@log,compress=zstd,noatime   0       1
UUID=75028dc8-40ef-4c97-8944-d8850c1ee107 /.snapshots    btrfs   subvol=@snapshots,compress=zstd,noatime   0       0
# /boot was on /dev/vda2 during installation
UUID=c8860b5b-e657-4ff2-acdb-e2a08947a7b5 /boot           ext4    defaults        0       2
# /boot/efi was on /dev/vda1 during installation
UUID=D643-B66B  /boot/efi       vfat    umask=0077      0       1
# /opt was on /dev/vda3 during installation
UUID=41565303-cab9-4cb6-9f9c-5ec5d8acbc0e /opt            xfs     defaults        0       0
/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
:wq
##########################
/etc/fstab verification
##########################
systemctl daemon-reload
mount -a

##########################
findmnt -t btrfs
cd /home
cp /tmp/*.tar.gz .
tar -xzf boris.tar.gz
#################
sudo chmod 750 /.snapshots
sudo umount /mnt/btrfs_base
sudo snapper -c root create --description "First baseline snapshot"

#################
System reboot
#################
$ sudo apt update
$ sudo apt install inotify-tools gawk git build-essential -y
$ git clone https://github.com/Antynea/grub-btrfs.git
$ cd grub-btrfs
$ sudo make install

###########################################
Make sure grub-btrfsd.service is correct
###########################################
$ sudo systemctl edit --full grub-btrfsd.service
$ sudo systemctl daemon-reload
$ sudo systemctl enable --now grub-btrfsd.service
$ sudo update-grub
$ sudo reboot

############ Overlay Setup ############
We need to swap out Debian's default initramfs-tools and replace it with Dracut, which natively understands the Fedora-style live overlay parameters.
$ sudo apt update
$ sudo apt install dracut dracut-core -y
########################################
Inject the working parameters exclusively into the Snapshot Configuration
$ sudo nano /etc/default/grub-btrfs/config
GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="'rd.live.overlay.overlayfs=1 rw'"
########################################
Force Dracut to re-build your active kernel images with overlay modules enabled
########################################
$ echo 'add_dracutmodules+=" overlayfs "' | sudo tee /etc/dracut.conf.d/overlayfs.conf
$ sudo dracut -H --hostonly-mode=sloppy --add overlayfs --force
$ sudo /etc/grub.d/41_snapshots-btrfs
#######################################
Finalize and update your master GRUB boot menu layout
$ sudo update-grub
#######################################

Overlay instance layout
############################
boris@Debian1510:~$ hostnamectl
 Static hostname: Debian1510
       Icon name: computer-vm
         Chassis: vm 💽
      Machine ID: edf88060aa784d0f9b7f14b3c6d1a8c1
         Boot ID: 8874785955e746679ce2d24ae4e5a257
  Virtualization: kvm
Operating System: Debian GNU/Linux forky/sid
          Kernel: Linux 7.2.9+deb14-amd64
    Architecture: x86-64
 Hardware Vendor: QEMU
  Hardware Model: Standard PC _Q35 + ICH9, 2009_
Hardware Version: pc-q35-11.1
Firmware Version: edk2-20260812-9.fc45
   Firmware Date: Wed 2026-08-12
    Firmware Age: 2month 3d

boris@Debian1510:~$ findmnt -t btrfs
TARGET          SOURCE                       FSTYPE OPTIONS
/run/rootfsbase /dev/vda4[/@snapshots/14/snapshot]
                                             btrfs  ro,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=276,subvol=/@snapshots/14/sn
/.snapshots     /dev/vda4[/@snapshots]       btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=258,subvol=/@snapshots
/home           /dev/vda4[/@home]            btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=259,subvol=/@home
/var/cache      /dev/vda4[/@cache]           btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=260,subvol=/@cache
/var/log        /dev/vda4[/@log]             btrfs  rw,noatime,compress=zstd:3,discard=async,space_cache=v2,subvolid=261,subvol=/@log
boris@Debian1510:~$ mount|grep 'on / '
LiveOS_rootfs on / type overlay (rw,relatime,lowerdir=/run/rootfsbase,upperdir=/run/overlayfs,workdir=/run/ovlwork,uuid=on)

 
boris@Debian1510:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1 vfat   FAT32       D643-B66B                              68.2M    12% /boot/efi
├─vda2 ext4   1.0         c8860b5b-e657-4ff2-acdb-e2a08947a7b5    1.6G     3% /boot
├─vda3 xfs                41565303-cab9-4cb6-9f9c-5ec5d8acbc0e   42.9G     2% /opt
└─vda4 btrfs              75028dc8-40ef-4c97-8944-d8850c1ee107   42.8G    13% /var/log
                                                                              /var/cache
                                                                              /home
                                                                              /.snapshots
                                                                              /run/rootfsbase

 

State-Isolated KVM Hypervisor Architecture on openSUSE Tumbleweed bare metal case (Assisted by Google AI)

Advantages of the YaST Installer
Extreme Customization During Setup: Unlike many rigid Linux installers that force you to accept default software or partitioning, YaST lets you modify virtually every parameter - including  complicated BTRFS/XFS disk layout, provides builtin interface for additional subvolumes decouple if it appears to be required, adding or removing specific software packages, desktop environments, and multimedia codecs before the installation even begins.

Centralized System Control: It acts as a single, unified control center for hardware configuration, partitioning, bootloader options, user accounts, and network setups. Reduced Need for CLI Knowledge: It bridges the gap for users who prefer a graphical interface (GUI) or text-based menu (ncurses) over manually editing low-level configuration files in the terminal.
YaST stands for Yet another Setup Tool, and it functions as both the primary operating system installer and the central system
configuration utility for SUSE Linux distributions 

******************
Final disk layout
******************
localhost:~ # hostnamectl
Transient hostname: localhost
   Static hostname: (unset)
         Icon name: computer-desktop
           Chassis: desktop 🖥
 Chassis Asset Tag: To be filled by O.E.M.
        Machine ID: 90c6a130b51143a285a54496a71901d8
           Boot ID: 5cefbc13c5004fe39cc1edf4a2422e05
      Product UUID: af95be8a-eace-8515-aaa1-00d861d9318b
  Operating System: openSUSE Tumbleweed
       CPE OS Name: cpe:2.3:o:opensuse:tumbleweed:20260922:*:*:*:*:*:*:*
            Kernel: Linux 7.2.6-1-default
      Architecture: x86-64
   Hardware Vendor: Micro-Star International Co., Ltd.
    Hardware Model: MS-7C37
   Hardware Serial: To be filled by O.E.M.
  Hardware Version: 3.0
  Firmware Version: H.60
     Firmware Date: Wed 2019-11-06
      Firmware Age: 6y 10month 2w 4d

localhost:~ # findmnt -t btrfs
TARGET              SOURCE                                    FSTYPE OPTIONS
/                   /dev/nvme1n1p4[/@/.snapshots/19/snapshot] btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=283,subvol=/@/.snapshots/19/snapshot
├─/.snapshots       /dev/nvme1n1p4[/@/.snapshots]             btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=263,subvol=/@/.snapshots
├─/etc/libvirt/qemu /dev/nvme1n1p4[/@/etc/libvirt/qemu]       btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=257,subvol=/@/etc/libvirt/qemu
├─/root             /dev/nvme1n1p4[/@/root]                   btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=261,subvol=/@/root
├─/home             /dev/nvme1n1p4[/@/home]                   btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=262,subvol=/@/home
├─/srv              /dev/nvme1n1p4[/@/srv]                    btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=260,subvol=/@/srv
├─/usr/local        /dev/nvme1n1p4[/@/usr/local]              btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=259,subvol=/@/usr/local
└─/var              /dev/nvme1n1p4[/@/var]                    btrfs  rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=258,subvol=/@/var

localhost:~ # df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /
devtmpfs       devtmpfs   16G     0   16G   0% /dev
tmpfs          tmpfs      16G     0   16G   0% /dev/shm
efivarfs       efivarfs  128K   28K   96K  23% /sys/firmware/efi/efivars
tmpfs          tmpfs     6.3G  1.9M  6.3G   1% /run
tmpfs          tmpfs      16G   20K   16G   1% /tmp
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /.snapshots
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /etc/libvirt/qemu
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /root
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /home
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /srv
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /usr/local
/dev/nvme1n1p4 btrfs     291G   14G  276G   5% /var
/dev/nvme1n1p2 ext4      2.0G  105M  1.7G   6% /boot
/dev/nvme1n1p3 xfs       185G   16G  169G   9% /opt
/dev/nvme1n1p1 vfat      511M  281M  231M  55% /boot/efi
tmpfs          tmpfs     3.2G   72K  3.2G   1% /run/user/1000
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/getty@tty1.service

********************************************************
Decouple of @/etc/libvirt/qemu was performed during
YaST Installer partition phase
**********************************************************
Suse Tumbleweed  redefining location of libvirt default pool
**********************************************************
# 1. Stop the modular QEMU daemon and its active socket
sudo systemctl stop virtqemud.service virtqemud.socket
sudo mkdir -p /opt/libvirt/images

# 2. Migrate existing images (if you have any)
if [ -d /var/lib/libvirt/images ] && [ "$(ls -A /var/lib/libvirt/images 2>/dev/null)" ]; then
   sudo mv /var/lib/libvirt/images/* /opt/libvirt/images/
fi

# 3. Configure folder permissions and SELinux contexts for Tumbleweed
sudo chown root:root /opt/libvirt/images
sudo chmod 0711 /opt/libvirt/images
sudo semanage fcontext -a -t virt_image_t "/opt/libvirt/images(/.*)?"
sudo restorecon -R -v /opt/libvirt/images

# 4. Restart the modular service/socket and reassign the default pool via virsh
sudo systemctl start virtqemud.socket virtqemud.service
sudo virsh pool-destroy default 2>/dev/null
sudo virsh pool-undefine default 2>/dev/null
sudo virsh pool-define-as default dir --target "/opt/libvirt/images"
sudo virsh pool-start default
sudo virsh pool-autostart default

# 5. Verify the configuration
sudo virsh pool-dumpxml default | grep path

**********************
Proof of concept
**********************
localhost:~ # df -Th /opt/libvirt/images
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/nvme0n1p3 xfs   185G  7.8G  177G   5% /opt

localhost:~ # ls -Zl /opt/libvirt/images
total 4394808
-rw-------. 1 qemu qemu system_u:object_r:svirt_image_t:s0:c421,c703 32217432064 Sep 24 07:22 ArchCosmic0924.qcow2
localhost:~ # ls -Zl /etc/libvirt/qemu
total 8
-rw-------. 1 root root system_u:object_r:virt_etc_rw_t:s0 8118 Sep 24 06:54 ArchCosmic0924.xml
drwx------. 1 root root system_u:object_r:virt_etc_rw_t:s0    0 Sep 16 17:09 autostart
drwx------. 1 root root system_u:object_r:virt_etc_rw_t:s0   40 Sep 24 06:17 networks  

***********************

Snapshot tracking                                    

***********************
localhost:~ # snapper -c root list |tail -5
 8  │ post   │     5 │ Thu 24 Sep 2026 06:10:49 AM EDT │ root │ 352.00 KiB │ number  │                           │
 9  │ pre    │       │ Thu 24 Sep 2026 06:22:47 AM EDT │ root │  28.00 MiB │ number  │ zypp(zypper)              │ important=no
10  │ post   │     9 │ Thu 24 Sep 2026 06:22:59 AM EDT │ root │  15.80 MiB │ number  │                           │ important=no
11  │ single │       │ Thu 24 Sep 2026 06:49:14 AM EDT │ root │  16.00 KiB │         │ KVM Setup.No vms deployed │
12  │ single │       │ Thu 24 Sep 2026 06:50:26 AM EDT │ root │  16.00 KiB │         │ KVM Setup. Arch ISO extracted    

ArchCosmic0924 deployed as L1 Guest.

localhost:~ # snapper rollback 12
Ambit is classic.
Creating read-only snapshot of current system. (Snapshot 13.)
Creating read-write snapshot of snapshot 12. (Snapshot 14.)
Setting default subvolume to snapshot 14.

System rebooted into /@/.snapshots/14/snapshot

boris@localhost:~> sudo su -
[sudo] password for root:
localhost:~ # mount | grep 'on / '
/dev/nvme1n1p4 on / type btrfs (rw,relatime,seclabel,ssd,discard=async,space_cache=v2,subvolid=278,subvol=/@/.snapshots/14/snapshot)
localhost:~ # virsh list --all
 Id   Name             State
--------------------------------
 1    ArchCosmic0924   running

State-Isolated KVM Hypervisor Architecture for Sparky 2026 06 (Assisted by Google AI)

 This architectural review validates a methodology for structural state-decoupling on a Linux hypervisor host. Traditional unified storage typologies expose nested. By designing a hybrid layout that maps the host operating system to a Timeshift-tracked Btrfs subvolume tree while binding guest runtime files to an independent, non-Copy-on-Write (No-CoW) enterprise XFS partition, we establish complete rollback immunity.
This review confirms that reverting the host root Timeshift snapshots leaves nested guest XML definitions and high-allocation QCOW2 volumes completely undisturbed and operationally continuous.

******************************************
Final Disk layout of Sparky 2026 06 instance
******************************************
root@devs-SW8664:~# uname -a
Linux devs-SW8664 7.1.13+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.13-1 (2026-09-03) x86_64 GNU/Linux

*************************************************************
Folder /opt was created during Calamares setup and formated as XFS.
**************************************************************
root@devs-SW8664:~# df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/vda3      btrfs      51G  7.6G   42G  16% /
devtmpfs       devtmpfs  7.6G     0  7.6G   0% /dev
tmpfs          tmpfs     7.6G  4.5M  7.6G   1% /dev/shm
efivarfs       efivarfs  256K   97K  154K  39% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G  1.1M  3.1G   1% /run
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
tmpfs          tmpfs     7.6G  8.0K  7.6G   1% /tmp
/dev/vda3      btrfs      51G  7.6G   42G  16% /home
/dev/vda3      btrfs      51G  7.6G   42G  16% /var/log
/dev/vda3      btrfs      51G  7.6G   42G  16% /var/cache
/dev/vda3      btrfs      51G  7.6G   42G  16% /etc/libvirt/qemu
/dev/vda2      ext4      2.0G  182M  1.7G  10% /boot
/dev/vda4      xfs        44G  5.4G   39G  13% /opt
/dev/vda1      vfat      300M   15M  286M   5% /boot/efi
tmpfs          tmpfs     1.6G  120K  1.6G   1% /run/user/1000

**************************************************************
Resulting btrfs flat layout after decoupling subvolume @qemu
**************************************************************
root@devs-SW8664:~# findmnt -t btrfs
TARGET         SOURCE             FSTYPE OPTIONS
/              /dev/vda3[/@]      btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=297,subvol=/@
├─/home        /dev/vda3[/@home]  btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=296,subvol=/@home
├─/etc/libvirt/qemu
│              /dev/vda3[/@qemu]  btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=283,subvol=/@qemu
├─/var/log     /dev/vda3[/@log]   btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@log
└─/var/cache   /dev/vda3[/@cache] btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@cache
**********************************************************
 Final status of default libvirt-pool after switching from /var/lib/libvirt/images to /opt/libvirt/images
**********************************************************

root@devs-SW8664:~# virsh pool-info default
Name:           default
UUID:           0a07f1dd-e6c6-4f0a-8fae-808662b9c7ab
State:          running
Persistent:     yes
Autostart:      yes
Capacity:       43.88 GiB
Allocation:     5.33 GiB
Available:      38.55 GiB

root@devs-SW8664:~# virsh pool-dumpxml default | grep path
   <path>/opt/libvirt/images</path>

*************************
Phase 1
*************************
Follows exactly Sparky Linux 2026 06 OverlayFS BTRFS with Timeshift setup

 ************************
Post installation Phase 2
************************
#1. Install KVM Hypervisor and Cockpit Web Console
#2. Decouple @qemu sub-volume mounted on /etc/libvirt/qemu

In particular case /dev/vda3 was formatted as XFS and    /dev/vda4 was formatted BTRFS

root@devs-SW8664:~# cat Setup001
# -- Step 1-2. Preparation: Create the subvolume first (assuming /mnt/btrfs-top is your top-level mount)
sudo mkdir -p /mnt/btrfs-top
sudo mount -o subvolid=5  /dev/vda4 /mnt/btrfs-top
sudo btrfs subvolume create /mnt/btrfs-top/@qemu

# --  Step 3: Sync data to a safe temporary location
sudo mkdir -p /mnt/temp-qemu
sudo mount -o subvol=@qemu /dev/vda4 /mnt/temp-qemu
sudo rsync -aHAX /etc/libvirt/qemu/ /mnt/temp-qemu/
sudo umount /mnt/temp-qemu

# -- CRITICAL SUB-STEP: Clear out the old directory contents before mounting over it
# (If you don't do this, old files remain hidden underneath, wasting space)
sudo rm -rf /etc/libvirt/qemu/*

# -- Step 4: Inject mapping (Using your actual Btrfs UUID from vda3)
echo "UUID=2f880c1f-d17c-4213-a515-0b1a78b1e6be  /etc/libvirt/qemu btrfs subvol=@qemu,defaults,compress=zstd:1 0 0" | \        sudo tee -a /etc/fstab

# -- Step 5: Reload and Mount
sudo systemctl daemon-reload
sudo mount -a

# -- Clean up the top-level mount
sudo umount /mnt/btrfs-top

#--Step 6. Apply Security and Ownership Integrity Restorations
# Ensure the new mount point maintains strict ownership for root and the libvirt group
sudo chown -R root:libvirt /etc/libvirt/qemu
sudo chmod 750 /etc/libvirt/qemu

# Reload AppArmor profiles to ensure libvirt recognizes the path changes flawlessly
sudo systemctl reload apparmor

# 6-1. Create the standard configuration subdirectories if they don't exist
sudo mkdir -p /etc/libvirt/qemu/autostart /etc/libvirt/qemu/networks

# 6-2. Reset strict ownership to root and the libvirt group
sudo chown -R root:libvirt /etc/libvirt/qemu

# 6-3. Apply secure permission bits (750 for qemu, 700 for subfolders)
sudo chmod 750 /etc/libvirt/qemu
sudo chmod 700 /etc/libvirt/qemu/autostart /etc/libvirt/qemu/networks

# 6-4. Restart libvirt to safely hook into the new subvolume
sudo systemctl restart libvirtd

*****************************************
#3. Switching to new libvirt-pool as root
*****************************************

mkdir -p /opt/libvirt/images

chown root:root /opt/libvirt/images   
chmod 0711 /opt/libvirt/images

# 1. Stop the active default pool
virsh pool-destroy default

# 2. Delete the old definition
virsh pool-undefine default

# 3. Define the new default pool path
virsh pool-define-as --name default --type dir --target /opt/libvirt/images

# 4. Start the pool and set it to autostart on boot
virsh pool-start default
virsh pool-autostart default

********************
Tuning apparmor
********************
root@devs-SVC8664:~#sudo nano /etc/apparmor.d/local/abstractions/libvirt-qemu
root@devs-SVC8664:~# cat /etc/apparmor.d/local/abstractions/libvirt-qemu
/opt/libvirt/images/** rwk,
root@devs-SVC8664:~# sudo systemctl reload apparmor

 

STATE-ISOLATED HYPERVISOR ARCHITECTURE FOR FEDORA RAWHIDE SERVER (Assisted by Google AI)

UPDATE as of 09/16/26                                                                          Fedora-Server-dvd-x86_64-45-20260915.n.0.iso keeps the same behavior as Beta1.3. See  https://lxer.com/module/forums/t/36959/

 END UPDATE

UPDATE as of 09/10/26                                                                             Same results were reproduced for   Fedora-Server-dvd-x86_64-45_Beta-1.3. Download link https://kojipkgs.fedoraproject.org/compose/45/Fedora-45-20260905.0/compose/Server/x86_64/iso/

boris@fedoraServer45D:~$ uname -a
Linux fedoraServer45D 7.2.4-300.fc45.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Sep  7 19:09:46 UTC 2026 x86_64 GNU/Linux

boris@fedoraServer45D:~$ findmnt -t btrfs
TARGET           SOURCE               FSTYPE OPTIONS
/                /dev/vda4[/@]        btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=269,subvol=/@
├─/home          /dev/vda4[/@home]    btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=260,subvol=/@home
├─/.snapshots    /dev/vda4[/snapshots]
│                                     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=256,subvol=/snapshots
├─/etc/libvirt/qemu
│                /dev/vda4[/@qemu]    btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=257,subvol=/@qemu
├─/var/cache     /dev/vda4[/@cache]   btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@cache
└─/var/log       /dev/vda4[/@log]     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@log
boris@fedoraServer45D:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 2188c871-f2ac-44e4-9eed-f66ba036167e                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       914C-DD2D                            1014.1M     1% /boot/efi
├─vda2 ext4   1.0         7679120e-fdbb-4d07-85c6-45c6d22244fd    1.4G    21% /boot
├─vda3 xfs                2edb3d1c-0667-4d8f-b288-5ddb151146a1   39.1G     2% /var/lib/libvirt/images
└─vda4 btrfs              ad91dab3-3a3c-4c0b-a4b0-928fcae7b43e   44.4G    12% /var/log
                                                                             /var/cache
                                                                             /etc/libvirt/qemu
                                                                             /home
                                                                             /.snapshots
                                                                             /

END UPDATE
UPDATE as of 09/01/26 

    If you are quite sure that KVM Hypervisor would be installed on Fedora Rawhide Server host Anaconda Blivet GUI allows to create required disk layout during partitioning phase

boris@fedoraSRV45:~$ uname -a
Linux fedoraSRV45 7.3.0-0.rc0.260819gbd5f485f3f02.5.fc46.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Aug 19 21:11:47 UTC 2026 x86_64 GNU/Linux
boris@fedoraSRV45:~$ findmnt -t btrfs
TARGET              SOURCE                FSTYPE OPTIONS
/                   /dev/vda4[/@]         btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=272,subvol=/@
├─/etc/libvirt/qemu /dev/vda4[/@qemu]     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=257,subvol=/@qemu
├─/.snapshots       /dev/vda4[/snapshots] btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=256,subvol=/snapshots
├─/var/cache        /dev/vda4[/@cache]    btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=259,subvol=/@cache
├─/home             /dev/vda4[/@home]     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=260,subvol=/@home
└─/var/log          /dev/vda4[/@log]      btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2, subvolid=258,subvol=/@log

END UPDATE 

This architectural review validates a methodology for structural state-decoupling on a Linux hypervisor host. Traditional unified storage typologies expose nested
Kernel-based Virtual Machine (KVM) instances to severe state de-synchronization or data corruption during host-level system recoveries. By designing a hybrid layout that maps the host operating system to a Snapper-tracked Btrfs subvolume tree while binding guest runtime files to an independent, non-Copy-on-Write (No-CoW) enterprise XFS partition, we establish complete rollback immunity. This review confirms that reverting the host root snapshot leaves nested guest XML definitions and high-allocation QCOW2 volumes completely undisturbed and operationally continuous.

-------------------------------------------------------------------------------------------------
I. STORAGE TOPOLOGY MATRIX & HARDWARE ADDRESSING
--------------------------------------------------------------------------------------------------
The underlying drive block layout is established during the initial Anaconda Blivet GUI partition phase. System metrics are mapped as follows:

  - /dev/vda1 -> /boot/efi                 [File System: vfat]
  - /dev/vda2 -> /boot                     [File System: ext4]
  - /dev/vda3 -> /var/lib/libvirt/images   [File System: XFS] (RHEL Production Standard)
  - /dev/vda4 -> Btrfs Parent Volume (ID 5) containing decoupled subvolumes:
                 ├── @                     -> /           (Host OS root, Snapper Target)
                 ├── @log                  -> /var/log    (Decoupled State Data)
                 ├── @cache                -> /var/cache  (Transient Package Buffers)
                 ├── @home                 -> /home       (User-space Persistence)
                 └── @qemu                 -> /etc/libvirt/qemu (Decoupled VM Metadata)

-----------------------------------------------------------------------------------------------------
II. DEPLOYMENT STACK & SUBVOLUME DECOUPLING SEQUENCE
----------------------------------------------------------------------------------------------------
Execute the following verification stack to initialize the infrastructure, migrate default configuration assets, and establish the persistent mount boundaries:

# 1. Initialize Hypervisor Packages and Web Management Daemons along with creating linux bridge via Cockpit Web Console.
sudo dnf install -y qemu-kvm libvirt cockpit cockpit-machines virt-manager
sudo systemctl enable --now libvirtd cockpit.socket

# 2. Mount Top-Level Btrfs Node and Instantiate the Target Subvolume
sudo mkdir -p /mnt/btrfs-top
sudo mount -o subvolid=5 /dev/vda4 /mnt/btrfs-top
sudo btrfs subvolume create /mnt/btrfs-top/@qemu

# 3. Synchronize Baseline Metadata and Preserve Extended System Attributes
sudo mkdir -p /mnt/temp-qemu
sudo mount -o subvol=@qemu /dev/vda4 /mnt/temp-qemu
sudo rsync -aHAX /etc/libvirt/qemu/ /mnt/temp-qemu/
sudo umount /mnt/temp-qemu
sudo umount /mnt/btrfs-top

# 4. Inject Permanent Storage Mapping Mappings into the File System Table
echo "UUID=f6bcd593-c35e-4584-bdf6-ac7e94be2181 /etc/libvirt/qemu btrfs subvol=/@qemu,defaults,compress=zstd:1 0 0" | sudo tee -a /etc/fstab

# 5. Force Systemd Unit Generation and Execute Uniform Mounting Sequence
sudo systemctl daemon-reload
sudo mount -a

# 6. Apply Security Context Integrity Restorations (SELinux Compliance)
sudo restorecon -Rv /etc/libvirt/qemu

------------------------------------------------------------
III. BASELINE IMMUTABILITY LOCK
-----------------------------------------------------------
Initialize the Snapper tracking configuration engine to isolate the root subvolume prior to launching or deploying secondary nested virtual machine profiles:

$ sudo umount /.snapshots
$ sudo rmdir    /.snapshots
$ sudo snapper -c root create-config  /
$ sudo mount  /.snapshots

for further details see Fedora Rawhide Server OverlayFS BTRFS setup

 
# 1. Capture Pristine System State (Establishes Reversion Target)
sudo snapper -c root create --description "Baseline-KVM-Decoupled"

# 2. Read System Timeline Index to Identify Target Snapshot ID
sudo snapper list

------------------------------------------------------------------------------
IV. NESTED GUEST DEPLOYMENT & OPERATION VERIFICATION
------------------------------------------------------------------------------
Deploy the nested guest (VMCachyOS) using the Virt-manager via linux bridge or direct QEMU CLI wrappers. Verify physical allocation routing across independent blocks:

# Validate that heavy storage disk traffic writes directly to the discrete XFS block
df -Th /var/lib/libvirt/images
ls -l /var/lib/libvirt/images/VMCachyOS.qcow2

# Validate that system operational XML files map to the separate @qemu Btrfs layer
df -Th /etc/libvirt/qemu
ls -l /etc/libvirt/qemu/VMCachyOS.xml

----------------------------------------------------------------------------------
V. VERIFICATION MATRIX: HOST SYSTEM STATE ROLLBACK
----------------------------------------------------------------------------------
To test disaster-recovery tolerance execute a reboot into the pre-deployment baseline index, run recovery via Btrfs-Assistant and reboot:

# 1. Revert Host OS Root Subvolume via booting into Overlay instance in Grub Submenu and recover using Btrfs-Assistant using snapshot been taken right before CachyOS VM (L2) deployment.

# 2. Cycle System Power States
sudo reboot

----------------------------------------------------------------------------
VI. CONCLUSION & STRUCTURAL INTEGRITY VALIDATION
----------------------------------------------------------------------------
Upon system initialization, execute structural verification to prove complete system decoupling. The test successfully confirms:

# 1. Functional Mount Points Restored Automatically
df -Th | grep -E 'qemu|images'

# 2. Complete Guest Configuration and Disk Image Survival
sudo ls -l /etc/libvirt/qemu/VMCachyOS.xml
sudo ls -l /var/lib/libvirt/images/VMCachyOS.qcow2

There are two reasons decoupled setup handled the rollback completely hands-off:

1.Persistent Extended Attributes: BTRFS stores SELinux labels as extended attributes (xattrs) directly inside the metadata of the subvolume itself (/@qemu). Because that subvolume is independent of root snapshot, its internal file contexts remain totally immutable during a root rollback.

2. Systemd Mount Order: When the system boots into the rolled-back snapshot, systemd processes /etc/fstab and mounts /@qemu subvolume directly over the root placeholder directory before the SELinux subsystem or Libvirt starts evaluating file access. SELinux reads the context of the active mount, which was preserved by original rsync -aHAX command.

CONCLUSION: Reverting the host OS leaves the hypervisor data completely intact. The KVM host configuration state remains perfectly synchronized and operational.

root@fedoraServer45FX:~# uname -a
Linux fedoraServer45FX 7.3.0-0.rc0.260819gbd5f485f3f02.5.fc46.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Aug 19 21:11:47 U
TC 2026 x86_64 GNU/Linux
root@fedoraServer45FX:~# lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 0ac33142-99e3-4006-8916-1262d59e1dbc                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       E6DA-C680                            1014.1M     1% /boot/efi
├─vda2 ext4   1.0         b50d0146-a877-4062-9fc8-4dd8734029d5    1.5G    17% /boot
├─vda3 xfs                cdd37892-dd02-45a8-a333-37635103eca9   22.7G    43% /var/lib/libvirt/images
└─vda4 btrfs              f6bcd593-c35e-4584-bdf6-ac7e94be2181   41.1G    19% /home
                                                                             /var/log
                                                                             /etc/libvirt/qemu
                                                                             /var/cache
                                                                             /.snapshots                                                                                                                      /

root@fedoraServer45FX:~# findmnt -t btrfs
TARGET           SOURCE               FSTYPE OPTIONS
/                /dev/vda4[/@]        btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=279,subvol=/@
├─/var/cache     /dev/vda4[/@cache]   btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@cache
├─/.snapshots    /dev/vda4[/snapshots]
│                                     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=256,subvol=/snapshots
├─/home          /dev/vda4[/@home]    btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@home
├─/var/log       /dev/vda4[/@log]     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=257,subvol=/@log
└─/etc/libvirt/qemu
                 /dev/vda4[/@qemu]    btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=272,subvol=/@qemu

Attempt to setup KVM Host on Sparky 2026.06 tolerant to Timeshift rollbacks (Assisted by Google AI )

 This post is an immediate follow up for  Sparky Linux 2026 06 OverlayFS BTRFS with Timeshift setup   We presume that KVM has been already setup on Sparky 2026.06, however neither one KVM guests have been created yet. Modern virtual machines use OVMF (Open Virtual Machine Firmware) to simulate an industry-standard UEFI environment rather than an old legacy BIOS.The Role of NVRAM: UEFI requires a non-volatile random-access memory (NVRAM) variables store to keep track of boot orders, hardware configurations, and Secure Boot certificates.Separation of Files: In KVM, the UEFI firmware itself is read-only (e.g., OVMF_CODE.fd), while the companion NVRAM file (e.g., OVMF_VARS.fd) stores the unique, writable state data for that specific VM.

In particular case, it would finally look like
root@devs-LV8664:~# uname -a
Linux devs-LV8664 7.1.8+deb14.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.8-2 (2026-08-15) x86_64 GNU/Linux

boris@devs-LV8664:~$ sudo su -
[sudo] password for boris:  
root@devs-LV8664:~# lsattr /var/lib/libvirt/qemu/nvram
---------------C------ /var/lib/libvirt/qemu/nvram/Garuda0827_VARS.fd
root@devs-LV8664:~# lsattr -d /var/lib/libvirt/qemu/nvram
---------------C------ /var/lib/libvirt/qemu/nvram
root@devs-LV8664:~# lsattr /var/lib/libvirt/images/*.qcow2
---------------C------ /var/lib/libvirt/images/Garuda0827.qcow2

 ===================================================

$ sudo mkdir -p /mnt/btrfs_top
$ sudo mount -o subvolid=5 /dev/vda3 /mnt/btrfs_top
$ sudo btrfs subvolume create /mnt/btrfs_top/@images
$ sudo btrfs subvolume create /mnt/btrfs_top/@qemu
$ sudo umount /mnt/btrfs_top
$ sudo rmdir /mnt/btrfs_top

Then add to /etc/fstab two rows
# DECOUPLED VM DATA & CONFIGS (Completely skipped during Timeshift rollbacks)
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/lib/libvirt/images  btrfs  subvol=@images,defaults,nodatacow  0  0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /etc/libvirt/qemu        btrfs  subvol=@qemu,defaults,compress=zstd:1 0  0                            

 $ sudo systemctl daemon-reload                                                           $ sudo mount -a
 $ sudo reboot
==================================================
Disable CoW on /var/lib/libvirt/images and nvram setup
==================================================
# 1. Clean up old failed files/folders to start fresh
rm -f /var/lib/libvirt/images/* 2>/dev/null

# 2. Apply the No-CoW flag to the images storage subvolume
chattr +C /var/lib/libvirt/images

# 3. Build the persistent NVRAM storage inside the isolated @qemu subvolume and  create the hypervisor NVRAM endpoint path
mkdir -p /etc/libvirt/qemu/nvram
chown libvirt-qemu:kvm /etc/libvirt/qemu/nvram
chmod 755 /etc/libvirt/qemu/nvram
mkdir -p /var/lib/libvirt/qemu/nvram
chmod 755 /var/libvirt/qemu/nvram

 
# 4. Strip BTRFS compression inheritance and apply No-CoW to the source directory
btrfs property set /etc/libvirt/qemu/nvram compression ""
chattr +C /etc/libvirt/qemu/nvram

# Set proper ownership and permissions
chown -R libvirt-qemu:kvm /etc/libvirt/qemu/nvram
chown -R libvirt-qemu:kvm /var/lib/libvirt/qemu/nvram
chmod 755 /etc/libvirt/qemu/nvram
chmod 755 /var/lib/libvirt/qemu/nvram

# 5. Execute the kernel directory bind mount
mount --bind /etc/libvirt/qemu/nvram /var/lib/libvirt/qemu/nvram

# 6. Ensure the mount persists across system restarts (FSTAB)
sed -i '\|/etc/libvirt/qemu/nvram|d' /etc/fstab
echo "/etc/libvirt/qemu/nvram  /var/lib/libvirt/qemu/nvram  none  bind  0  0" >> /etc/fstab

# 7. Completely disable AppArmor for QEMU to avoid profile load crashes
sed -i 's/^#\?security_driver =.*/security_driver = "none"/' /etc/libvirt/qemu.conf
if ! grep -q '^security_driver = "none"' /etc/libvirt/qemu.conf; then
    echo 'security_driver = "none"' >> /etc/libvirt/qemu.conf
fi
#8. Cycle the daemons to completely finalize initialization
systemctl daemon-reload
mount -a
systemctl restart apparmor
systemctl restart libvirtd

root@devs-LV8664:~# cat /etc/fstab
# /etc/fstab: static file system information.
#
# <file system>             <mount point>  <type>  <options>  <dump>  <pass>
UUID=97E5-166D                             /boot/efi      vfat    defaults,umask=0077 0 2
UUID=66ed69e1-91ff-47e7-9a4f-88afb3fdc5ac  /boot          ext4    defaults   0 2
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /              btrfs   subvol=/@,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /home          btrfs   subvol=/@home,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/cache     btrfs   subvol=/@cache,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/log       btrfs   subvol=/@log,defaults,compress=zstd:1 0 0
# DECOUPLED VM DATA & CONFIGS (Completely skipped during Timeshift rollbacks)
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/lib/libvirt/images  btrfs  subvol=@images,defaults,nodatacow  0  0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /etc/libvirt/qemu        btrfs  subvol=@qemu,defaults,compress=zstd:1 0  0
/etc/libvirt/qemu/nvram  /var/lib/libvirt/qemu/nvram  none  bind  0  0

Finally we get 

root@devs-LV8664:~# uname -a
Linux devs-LV8664 7.1.8+deb14.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.8-2 (2026-08-15) x86_64 GNU/Linux
root@devs-LV8664:~# findmnt -t btrfs
TARGET                 SOURCE               FSTYPE OPTIONS
/                      /dev/vda3[/@]        btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=317,subvol=/@
├─/var/lib/libvirt/qemu/nvram
│                      /dev/vda3[/@qemu/nvram]
│                                           btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/@qemu
├─/home                /dev/vda3[/@home]    btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=298,subvol=/@home
├─/etc/libvirt/qemu    /dev/vda3[/@qemu]    btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/@qemu
├─/var/cache           /dev/vda3[/@cache]   btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@cache
├─/var/lib/libvirt/images
│                      /dev/vda3[/@images]  btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=307,subvol=/@image
└─/var/log             /dev/vda3[/@log]     btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@log

 
root@devs-LV8664:~# lsattr -d /var/lib/libvirt/images
---------------C------ /var/lib/libvirt/images
root@devs-LV8664:~# lsattr /var/lib/libvirt/images/*.qcow2
---------------C------ /var/lib/libvirt/images/VM01CH.qcow2

 
root@devs-LV8664:~# # Create Timeshift snapshot at this point
root@devs-LV8664:~# # After deployment the first KVM Guest

 
root@devs-LV8664:~# cat Verification.sh
echo -e "\n=== 1. Verifying Automated NVRAM Bind Mount ==="
findmnt /var/lib/libvirt/qemu/nvram

echo -e "\n=== 2. Verifying Persistent NVRAM File Status ==="
lsattr  /etc/libvirt/qemu/nvram/

echo -e "\n=== 3. Verifying AppArmor Disablement Protection ==="
grep "^security_driver" /etc/libvirt/qemu.conf

root@devs-LV8664:~# ./Verification.sh

=== 1. Verifying Automated NVRAM Bind Mount ===
TARGET                     SOURCE                 FSTYPE OPTIONS
/var/lib/libvirt/qemu/nvram
                          /dev/vda3[/@qemu/nvram]
                                                 btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/ @qemu

=== 2. Verifying Persistent NVRAM File Status ===
---------------C------ /etc/libvirt/qemu/nvram/VM05CH_VARS.fd

=== 3. Verifying AppArmor Disablement Protection ===
security_driver = "none"