Attempt to setup KVM Host on Sparky 2026.06 tolerant to Timeshift rollbacks (Assisted by Google AI )

 This post is an immediate follow up for  Sparky Linux 2026 06 OverlayFS BTRFS with Timeshift setup   We presume that KVM has been already setup on Sparky 2026.06, however neither one KVM guests have been created yet. Modern virtual machines use OVMF (Open Virtual Machine Firmware) to simulate an industry-standard UEFI environment rather than an old legacy BIOS.The Role of NVRAM: UEFI requires a non-volatile random-access memory (NVRAM) variables store to keep track of boot orders, hardware configurations, and Secure Boot certificates.Separation of Files: In KVM, the UEFI firmware itself is read-only (e.g., OVMF_CODE.fd), while the companion NVRAM file (e.g., OVMF_VARS.fd) stores the unique, writable state data for that specific VM.

In particular case, it would finally look like
root@devs-LV8664:~# uname -a
Linux devs-LV8664 7.1.8+deb14.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.8-2 (2026-08-15) x86_64 GNU/Linux

boris@devs-LV8664:~$ sudo su -
[sudo] password for boris:  
root@devs-LV8664:~# lsattr /var/lib/libvirt/qemu/nvram
---------------C------ /var/lib/libvirt/qemu/nvram/Garuda0827_VARS.fd
root@devs-LV8664:~# lsattr -d /var/lib/libvirt/qemu/nvram
---------------C------ /var/lib/libvirt/qemu/nvram
root@devs-LV8664:~# lsattr /var/lib/libvirt/images/*.qcow2
---------------C------ /var/lib/libvirt/images/Garuda0827.qcow2

 ===================================================

$ sudo mkdir -p /mnt/btrfs_top
$ sudo mount -o subvolid=5 /dev/vda3 /mnt/btrfs_top
$ sudo btrfs subvolume create /mnt/btrfs_top/@images
$ sudo btrfs subvolume create /mnt/btrfs_top/@qemu
$ sudo umount /mnt/btrfs_top
$ sudo rmdir /mnt/btrfs_top

Then add to /etc/fstab two rows
# DECOUPLED VM DATA & CONFIGS (Completely skipped during Timeshift rollbacks)
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/lib/libvirt/images  btrfs  subvol=@images,defaults,nodatacow  0  0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /etc/libvirt/qemu        btrfs  subvol=@qemu,defaults,compress=zstd:1 0  0                            

 $ sudo systemctl daemon-reload                                                           $ sudo mount -a
 $ sudo reboot
==================================================
Disable CoW on /var/lib/libvirt/images and nvram setup
==================================================
# 1. Clean up old failed files/folders to start fresh
rm -f /var/lib/libvirt/images/* 2>/dev/null

# 2. Apply the No-CoW flag to the images storage subvolume
chattr +C /var/lib/libvirt/images

# 3. Build the persistent NVRAM storage inside the isolated @qemu subvolume and  create the hypervisor NVRAM endpoint path
mkdir -p /etc/libvirt/qemu/nvram
chown libvirt-qemu:kvm /etc/libvirt/qemu/nvram
chmod 755 /etc/libvirt/qemu/nvram
mkdir -p /var/lib/libvirt/qemu/nvram
chmod 755 /var/libvirt/qemu/nvram

 
# 4. Strip BTRFS compression inheritance and apply No-CoW to the source directory
btrfs property set /etc/libvirt/qemu/nvram compression ""
chattr +C /etc/libvirt/qemu/nvram

# Set proper ownership and permissions
chown -R libvirt-qemu:kvm /etc/libvirt/qemu/nvram
chown -R libvirt-qemu:kvm /var/lib/libvirt/qemu/nvram
chmod 755 /etc/libvirt/qemu/nvram
chmod 755 /var/lib/libvirt/qemu/nvram

# 5. Execute the kernel directory bind mount
mount --bind /etc/libvirt/qemu/nvram /var/lib/libvirt/qemu/nvram

# 6. Ensure the mount persists across system restarts (FSTAB)
sed -i '\|/etc/libvirt/qemu/nvram|d' /etc/fstab
echo "/etc/libvirt/qemu/nvram  /var/lib/libvirt/qemu/nvram  none  bind  0  0" >> /etc/fstab

# 7. Completely disable AppArmor for QEMU to avoid profile load crashes
sed -i 's/^#\?security_driver =.*/security_driver = "none"/' /etc/libvirt/qemu.conf
if ! grep -q '^security_driver = "none"' /etc/libvirt/qemu.conf; then
    echo 'security_driver = "none"' >> /etc/libvirt/qemu.conf
fi
#8. Cycle the daemons to completely finalize initialization
systemctl daemon-reload
mount -a
systemctl restart apparmor
systemctl restart libvirtd

root@devs-LV8664:~# cat /etc/fstab
# /etc/fstab: static file system information.
#
# <file system>             <mount point>  <type>  <options>  <dump>  <pass>
UUID=97E5-166D                             /boot/efi      vfat    defaults,umask=0077 0 2
UUID=66ed69e1-91ff-47e7-9a4f-88afb3fdc5ac  /boot          ext4    defaults   0 2
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /              btrfs   subvol=/@,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /home          btrfs   subvol=/@home,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/cache     btrfs   subvol=/@cache,defaults,compress=zstd:1 0 0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/log       btrfs   subvol=/@log,defaults,compress=zstd:1 0 0
# DECOUPLED VM DATA & CONFIGS (Completely skipped during Timeshift rollbacks)
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /var/lib/libvirt/images  btrfs  subvol=@images,defaults,nodatacow  0  0
UUID=f85d880c-2c08-4a56-b645-ff030bd29433  /etc/libvirt/qemu        btrfs  subvol=@qemu,defaults,compress=zstd:1 0  0
/etc/libvirt/qemu/nvram  /var/lib/libvirt/qemu/nvram  none  bind  0  0

Finally we get 

root@devs-LV8664:~# uname -a
Linux devs-LV8664 7.1.8+deb14.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.8-2 (2026-08-15) x86_64 GNU/Linux
root@devs-LV8664:~# findmnt -t btrfs
TARGET                 SOURCE               FSTYPE OPTIONS
/                      /dev/vda3[/@]        btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=317,subvol=/@
├─/var/lib/libvirt/qemu/nvram
│                      /dev/vda3[/@qemu/nvram]
│                                           btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/@qemu
├─/home                /dev/vda3[/@home]    btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=298,subvol=/@home
├─/etc/libvirt/qemu    /dev/vda3[/@qemu]    btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/@qemu
├─/var/cache           /dev/vda3[/@cache]   btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@cache
├─/var/lib/libvirt/images
│                      /dev/vda3[/@images]  btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=307,subvol=/@image
└─/var/log             /dev/vda3[/@log]     btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@log

 
root@devs-LV8664:~# lsattr -d /var/lib/libvirt/images
---------------C------ /var/lib/libvirt/images
root@devs-LV8664:~# lsattr /var/lib/libvirt/images/*.qcow2
---------------C------ /var/lib/libvirt/images/VM01CH.qcow2

 
root@devs-LV8664:~# # Create Timeshift snapshot at this point
root@devs-LV8664:~# # After deployment the first KVM Guest

 
root@devs-LV8664:~# cat Verification.sh
echo -e "\n=== 1. Verifying Automated NVRAM Bind Mount ==="
findmnt /var/lib/libvirt/qemu/nvram

echo -e "\n=== 2. Verifying Persistent NVRAM File Status ==="
lsattr  /etc/libvirt/qemu/nvram/

echo -e "\n=== 3. Verifying AppArmor Disablement Protection ==="
grep "^security_driver" /etc/libvirt/qemu.conf

root@devs-LV8664:~# ./Verification.sh

=== 1. Verifying Automated NVRAM Bind Mount ===
TARGET                     SOURCE                 FSTYPE OPTIONS
/var/lib/libvirt/qemu/nvram
                          /dev/vda3[/@qemu/nvram]
                                                 btrfs  rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=308,subvol=/ @qemu

=== 2. Verifying Persistent NVRAM File Status ===
---------------C------ /etc/libvirt/qemu/nvram/VM05CH_VARS.fd

=== 3. Verifying AppArmor Disablement Protection ===
security_driver = "none"

 

 

Fedora Rawhide Server OverlayFS BTRFS setup

 Configuring Fedora Rawhide Server using a combination of Btrfs and OverlayFS creates a secure testing environment. This configuration isolates critical for tracking rapidly evolving Rawhide packages from developers allowing the server to load read-only Btrfs base snapshots while using the OverlayFS layer as a storage layer for writing and temporary data. If an update disrupts the OS, the base snapshot remains intact, allowing for rollback after a single reboot. Same configuration may also work and vice versa way. Btrfs-assistant running inside Overlay instance booted via corresponding option of Grub Submenu allows to recover from crash main instance via selection required "ro" snaphot using it's own GUI.

Original disk layout created via Anaconda Blivet GUI

boris@fedoraSRV45:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 36997738-0002-4ac8-a610-5fa763846448                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       59C6-BE04                            1014.1M     1% /boot/efi
├─vda2 ext4   1.0         3c0092f6-68b7-46c4-9443-c18b91a93298    1.5G    17% /boot
└─vda3 btrfs              a8856089-210e-42ff-8ba4-5f53f91a8dee   59.4G     9% /var/log
                                                                             /var/cache
                                                                             /home
                                                                             /.snapshots
                                                                             /

$ sudo dnf install btrfs-assistant snapper gawk inotify-tools libdnf5-plugin-actions git make -y
$ sudo dnf install python3-btrfsutil dracut-live -y 

========================
Trick Snapper Method
========================
$ sudo umount /.snapshots
$ sudo rmdir    /.snapshots
$ sudo snapper -c root create-config  /
$ sudo mount  /.snapshots

Create the missing directory: 

$ sudo mkdir -p /boot/grub
$ sudo dnf install grub2-tools 

# Fix binary compatibility wrapper

$ sudo ln -sf /usr/bin/grub2-script-check /usr/bin/grub-script-check

$ git clone https://github.com/Antynea/grub-btrfs.git

$ cd grub-btrfs

================

UNDER grub-config

================

$ nano config

GRUB_BTRFS_MKCONFIG="/usr/bin/grub2-mkconfig"

GRUB_BTRFS_GRUB_DIRNAME="/boot/grub2"

GRUB_BTRFS_SCRIPT_CHECK="grub2-script-check"

========================================

# Compile package targets
$ sudo make install 

 

boris@fedoraSRV45:~$ cat /etc/fstab
#
UUID=a8856089-210e-42ff-8ba4-5f53f91a8dee / btrfs subvol=@,compress=zstd:1 0 0
UUID=a8856089-210e-42ff-8ba4-5f53f91a8dee /.snapshots btrfs subvol=snapshots,compress=zstd:1 0 0
UUID=3c0092f6-68b7-46c4-9443-c18b91a93298 /boot ext4 defaults 1 2
UUID=59C6-BE04 /boot/efi vfat umask=0077,shortname=winnt 0 2
UUID=a8856089-210e-42ff-8ba4-5f53f91a8dee /home btrfs subvol=@home,compress=zstd:1 0 0
UUID=a8856089-210e-42ff-8ba4-5f53f91a8dee /var/cache btrfs subvol=@cache,compress=zstd:1 0 0
UUID=a8856089-210e-42ff-8ba4-5f53f91a8dee /var/log btrfs subvol=@log,compress=zstd:1 0 0
 ===============================

sudo nano /etc/btrfs-assistant.conf

===============================

[Subvol-Mapping]

root = "snapshots,@,a8856089-210e-42ff-8ba4-5f53f91a8dee"

 

[Backup-Mapping]

/ = "@"

================================

sudo nano /etc/snapper/configs/root

================================

SUBVOLUME="/" 

===============================

sudo nano /etc/default/grub-btrfs/config

===============================

GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS=

="'rd.live.overlay.overlayfs=1'" 

==============================

 Overlay Setup

==============================

$ echo 'add_dracutmodules+=" overlayfs "' | sudo tee /etc/dracut.conf.d/overlayfs.conf

$ sudo dracut -f --regenerate-all

$ sudo rm -f /boot/grub2/grub-btrfs.new /tmp/grub-btrfs.*

$ sudo /etc/grub.d/41_snapshots-btrfs

$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

$ sudo systemctl daemon-reload

$ sudo systemctl enable --now grub-btrfsd

 

boris@fedoraSRV45:~$ uname -a
Linux fedoraSRV45 7.2.0-61.fc46.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Aug 17 12:34:38 UTC 2026 x86_64 GNU/Linux

boris@fedoraSRV45:~$ mount | grep 'on / '
LiveOS_rootfs on / type overlay (rw,relatime,seclabel,lowerdir=/run/rootfsbase,upperdir=/run/overlayfs,workdir=/run/ovlwork,uuid=on)

 
boris@fedoraSRV45:~$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
LiveOS_rootfs  overlay   3.1G   25M  3.1G   1% /
devtmpfs       devtmpfs  7.6G     0  7.6G   0% /dev
tmpfs          tmpfs     7.6G   96K  7.6G   1% /dev/shm
efivarfs       efivarfs  256K  114K  137K  46% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G   25M  3.1G   1% /run
/dev/vda3      btrfs      67G  6.2G   60G  10% /run/rootfsbase
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-resolved.service
/dev/vda3      btrfs      67G  6.2G   60G  10% /.snapshots
/dev/vda3      btrfs      67G  6.2G   60G  10% /home
tmpfs          tmpfs     7.6G  4.0K  7.6G   1% /tmp
/dev/vda2      ext4      2.0G  326M  1.5G  18% /boot
/dev/vda3      btrfs      67G  6.2G   60G  10% /var/cache
/dev/vda3      btrfs      67G  6.2G   60G  10% /var/log
/dev/vda1      vfat     1022M  8.0M 1015M   1% /boot/efi
tmpfs          tmpfs     1.6G   88K  1.6G   1% /run/user/1000

 
boris@fedoraSRV45:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 1a27ea82-33c1-4e83-818c-9da7d6e0b738                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       59C6-BE04                            1014.1M     1% /boot/efi
├─vda2 ext4   1.0         3c0092f6-68b7-46c4-9443-c18b91a93298    1.5G    17% /boot
└─vda3 btrfs              a8856089-210e-42ff-8ba4-5f53f91a8dee   59.4G     9% /var/log
                                                                             /var/cache
                                                                             /home
                                                                             /.snapshots
                                                                             /run/rootfsbase

Main fedora Server Rawhide instance (as of 08/18/26)

 

Building an Indestructible Debian Sandbox on SparkyLinux 8.4 + True OverlayFS (Assisted by Google AI)

 Review

  The holy grail of desktop engineering is a true immutable sandbox: the ability to boot into a historical snapshot, run risky updates or delete critical system binaries, and have those changes vanish into thin air upon a reboot. To solve this, SparkyLinux 8.4 was chosed (the leanest Debian testing base available) to build a 100% contained RAM sandbox from scratch.
This post is an immediate follow up for https://lxer.com/module/newswire/view/366777/index.html 

On Sparky 8.4 up on completion of basic deployment we would have to add two btrfs subvolumes
$ sudo mkdir -p /mnt/btrfs_top
$ sudo mount -o subvolid=5 /dev/vda3 /mnt/btrfs_top
$ sudo btrfs subvolume create /mnt/btrfs_top/@cache
$ sudo btrfs subvolume create /mnt/btrfs_top/@log
$ sudo umount /mnt/btrfs_top
$ sudo rmdir /mnt/btrfs_top

Then add to /etc/fstab two rows
sudo tee -a /etc/fstab << 'EOF'
UUID=BTRFS-UUID  /var/cache     btrfs   subvol=/@cache,defaults 0 0
UUID=BTRFS-UUID  /var/log       btrfs   subvol=/@log,defaults 0 0
EOF

$ sudo systemctl daemon-reload
$ sudo mount -a
==============================================
Phase of Overlay Setup should look as follows
==============================================
$ sudo apt update
$ sudo apt install dracut dracut-core -y

Then update the line starting with "mount -t overlay LiveOS_rootfs" in file /usr/lib/dracut/modules.d/90overlayfs/mount-overlayfs.sh as shown below

if ! strstr "$(cat /proc/mounts)" LiveOS_rootfs; then

      mount -t overlay LiveOS_rootfs -o "$ovlfs",upperdir=/run/overlayfs,workdir=/run/ovlwork "$NEWROOT"

fi
==============================================
Inject the working parameters exclusively into the Snapshot Configuration
$ sudo nano /etc/default/grub-btrfs/config
GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="'rd.live.overlay.overlayfs=1'"

$ echo 'add_dracutmodules+=" overlayfs "' | sudo tee /etc/dracut.conf.d/overlayfs.conf
$ sudo dracut -H --hostonly-mode=sloppy --add overlayfs --force
$ sudo update-grub

 

Overlay instance status

 boris@devs-stable:~$ uname -a
Linux devs-stable 6.12.101+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.101-1 (2026-08-05) x86_64 GNU/Linux
boris@devs-stable:~$ mount | grep 'on / '
LiveOS_rootfs on / type overlay (rw,relatime,lowerdir=/run/rootfsbase,upperdir=/run/overlayfs,workdir=/run/ovlwork,uuid=on)

boris@devs-stable:~$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
LiveOS_rootfs  overlay   3.1G  9.6M  3.1G   1% /run/rootfsbase
devtmpfs       devtmpfs  4.0M     0  4.0M   0% /dev
tmpfs          tmpfs     7.6G   12K  7.6G   1% /dev/shm
efivarfs       efivarfs  256K  138K  114K  55% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G  9.6M  3.1G   1% /run
tmpfs          tmpfs     5.0M  8.0K  5.0M   1% /run/lock
tmpfs          tmpfs     7.6G  8.0K  7.6G   1% /tmp
tmpfs          tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
/dev/vda3      btrfs      68G  7.9G   59G  12% /home
/dev/vda3      btrfs      68G  7.9G   59G  12% /var/cache
/dev/vda3      btrfs      68G  7.9G   59G  12% /var/log
/dev/vda2      ext4      2.0G   48M  1.8G   3% /boot
/dev/vda1      vfat      300M   12M  288M   4% /boot/efi
tmpfs          tmpfs     1.6G  112K  1.6G   1% /run/user/1000

boris@devs-stable:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1 vfat   FAT32       BC5B-499E                             287.8M     4% /boot/efi
├─vda2 ext4   1.0         47eb48b0-7552-4db8-a77a-ce37c5fa83e4    1.7G     2% /boot
└─vda3 btrfs              0ef48971-0c2d-4498-a2cb-b0ad655ac160   58.3G    12% /var/log
                                                                              /var/cache
                                                                              /home
                                                                              /run/rootfsbase

Sparky Linux 2026 06 OverlayFS BTRFS with Timeshift setup (Assisted by Google AI)

 Review 

Turning on OverlayFS on top of a Btrfs base setup in Sparky Linux 2026.06 brings a fundamentally different set of advantages compared to a standard deployment utilizing Btrfs subvolumes and Timeshift. While both configurations leverage Btrfs, they serve completely different operational philosophies: Timeshift provides a reactive "point-in-time recovery" safety net, whereas OverlayFS converts the environment into a proactive, transient "stateless or immutable" sandboxed workstation. 

Proceed as follows 

$ sudo apt update
$ sudo apt install inotify-tools gawk timeshift
$ git clone https://github.com/Antynea/grub-btrfs.git
$ cd grub-btrfs
$ sudo make install
$ sudo systemctl edit --full grub-btrfsd.service
[Service]
ExecStart=
ExecStart=/usr/bin/grub-btrfsd --syslog --timeshift-auto
=========================================
$ sudo systemctl daemon-reload
$ sudo systemctl enable --now grub-btrfsd.service
$ sudo update-grub                                                                                    $ sudo reboot

=========================================
Install timeshift-autosnap-apt
=========================================
Run the following commands to clone the automation script and install it to your system:
=========================================
$ git clone https://github.com/wmutschl/timeshift-autosnap-apt.git
$ cd timeshift-autosnap-apt
$ sudo make install
=========================================
Quick Verification CheckOnce the installation script finishes tracking files into your /etc/apt/apt.conf.d/ hooks, you can test the manual wrapper parsing structure by executing:
sudo timeshift-autosnap-apt
=========================================
# Verify the configuration file exists:
ls -l /etc/timeshift-autosnap-apt.conf
# Verify the APT hook is active:
ls -l /etc/apt/apt.conf.d/80-timeshift-autosnap-apt
# Verify the executable script is in your system path:
ls -l /usr/bin/timeshift-autosnap-apt
=========================================

$ sudo update-grub                                                                                      $ sudo reboot
==============Overlay Setup =============
We need to swap out Debian's default initramfs-tools and replace it with Dracut, which natively understands the Fedora-style live overlay parameters.
$ sudo apt update
$ sudo apt install dracut dracut-core -y
=============================================
Inject the working parameters exclusively into the Snapshot Configuration
$ sudo nano /etc/default/grub-btrfs/config
GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="'rd.live.overlay.overlayfs=1 rw'"
==========================================
Force Dracut to re-build your active kernel images with overlay modules enabled
==========================================
$ echo 'add_dracutmodules+=" overlayfs "' | sudo tee /etc/dracut.conf.d/overlayfs.conf
$ sudo dracut -H --hostonly-mode=sloppy --add overlayfs --force
==========================================
Finalize and update your master GRUB boot menu layout
$ sudo update-grub 

Mounting the Lower Layer: Dracut maps your physical Btrfs snapshot (e.g., @the-timeshift-snapshot-name) as a pristine, read-only (ro) lower directory at /run/rootfsbase. Creating the Upper Layer: Because you haven't explicitly attached an external physical drive partition or configured a specific size flag, Dracut calculates a default fallback environment. It looks at your virtual /run directory—which systemd allocates as a memory-backed tmpfs slice restricted to roughly 20% to 40% of available memory architecture defaults .    The Stitching: Dracut creates /run/overlayfs (the writeable layer) and /run/ovlwork (the system scratch directory) directly inside that RAM allocation.
It then uses the kernel's OverlayFS driver to merge /run/rootfsbase and /run/overlayfs into a virtual root device called LiveOS_rootfs.
==================================================
When Dracut exits and hands control over to Sparky Linux's systemd initialization, the operating system interacts entirely with LiveOS_rootfs mounted on / .  If an application tries to modify a file in /etc, /usr, or /opt, the kernel catches the file manipulation, pulls the original file from the read-only Btrfs snapshot, applies the modification, and writes it directly to your RAM buffer. The "Leak" Behavior: Because your /etc/fstab inside that snapshot contains explicit, hardcoded instructions to mount /home, /var/log, and /var/cache using their specific subvolume IDs (subvolid=346 or subvol=/@home), systemd reads those lines and explicitly mounts your real physical drive right over those specific directories. This is why /home remains persistent, while / is sandboxed.

 

boris@devs-XV8664:~$ uname -a
Linux devs-XV8664 7.1.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.7-1 (2026-08-07) x86_64 GNU/Linux
boris@devs-XV8664:~$ mount | grep 'on / '
LiveOS_rootfs on / type overlay (rw,relatime,lowerdir=/run/rootfsbase,upperdir=/run/overlayfs,workdir=/run/ovlwork,uuid=on)
boris@devs-XV8664:~$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
LiveOS_rootfs  overlay   3.1G  1.4M  3.1G   1% /
devtmpfs       devtmpfs  7.6G     0  7.6G   0% /dev
tmpfs          tmpfs     7.6G   12K  7.6G   1% /dev/shm
efivarfs       efivarfs  256K  125K  127K  50% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G  1.4M  3.1G   1% /run
/dev/vda3      btrfs      63G  6.2G   56G  11% /run/rootfsbase
tmpfs          tmpfs     7.6G   12K  7.6G   1% /tmp
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
/dev/vda3      btrfs      63G  6.2G   56G  11% /var/log
/dev/vda3      btrfs      63G  6.2G   56G  11% /var/cache
/dev/vda3      btrfs      63G  6.2G   56G  11% /home
/dev/vda2      ext4      2.0G  181M  1.7G  10% /boot
/dev/vda1      vfat      511M   15M  497M   3% /boot/efi
tmpfs          tmpfs     1.6G   80K  1.6G   1% /run/user/1000

 
boris@devs-XV8664:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
vda                                                                            
├─vda1 vfat   FAT32       B174-924B                             496.9M     3% /boot/efi
├─vda2 ext4   1.0         6debd835-d6e3-427f-bb85-e5e0ba944e5a    1.6G     9% /boot
└─vda3 btrfs              2ef2dcbc-5404-4e81-b915-7367c2ed259d     55G                                                                                                                                       10% /home
                               /var/cache
                               /var/log
                               /run/rootfsbase

 
 How dangerous are leaks at /home on Sparky/Timeshift Overlay instances ? Please compare this two greps

root@devs-XV8664:~# uname -a
Linux devs-XV8664 7.1.7+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.7-1 (2026-08-07) x86_64 GNU/Linux
root@devs-XV8664:~# btrfs subvolume list / | grep -v home
ID 258 gen 2197 top level 5 path @cache
ID 259 gen 2217 top level 5 path @log
ID 324 gen 1549 top level 5 path timeshift-btrfs/snapshots/2026-08-11_10-52-13/@
ID 331 gen 1543 top level 5 path timeshift-btrfs/snapshots/2026-08-11_10-48-18/@
ID 334 gen 1701 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-47-26/@
ID 335 gen 1623 top level 5 path timeshift-btrfs/snapshots/2026-08-11_11-16-19/@
ID 339 gen 1696 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-43-18/@
ID 342 gen 1733 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-54-31/@
ID 343 gen 1725 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-49-21/@
ID 346 gen 2041 top level 5 path timeshift-btrfs/snapshots/2026-08-12_04-38-11/@
ID 347 gen 1759 top level 5 path timeshift-btrfs/snapshots/2026-08-12_01-38-26/@
ID 349 gen 1968 top level 5 path timeshift-btrfs/snapshots/2026-08-12_03-37-00/@
ID 351 gen 2036 top level 5 path timeshift-btrfs/snapshots/2026-08-12_04-34-45/@
ID 354 gen 2216 top level 5 path @
ID 355 gen 2181 top level 5 path timeshift-btrfs/snapshots/2026-08-12_06-08-42/@

 
root@devs-XV8664:~# btrfs subvolume list / | grep  home
ID 323 gen 1561 top level 5 path timeshift-btrfs/snapshots/2026-08-11_10-52-13/@home
ID 332 gen 1544 top level 5 path timeshift-btrfs/snapshots/2026-08-11_10-48-18/@home
ID 333 gen 1715 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-47-26/@home
ID 336 gen 1624 top level 5 path timeshift-btrfs/snapshots/2026-08-11_11-16-19/@home
ID 340 gen 1697 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-43-18/@home
ID 341 gen 1743 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-54-31/@home
ID 344 gen 1726 top level 5 path timeshift-btrfs/snapshots/2026-08-11_15-49-21/@home
ID 345 gen 2054 top level 5 path timeshift-btrfs/snapshots/2026-08-12_04-38-11/@home
ID 348 gen 1760 top level 5 path timeshift-btrfs/snapshots/2026-08-12_01-38-26/@home
ID 350 gen 1969 top level 5 path timeshift-btrfs/snapshots/2026-08-12_03-37-00/@home
ID 352 gen 2037 top level 5 path timeshift-btrfs/snapshots/2026-08-12_04-34-45/@home
ID 353 gen 2217 top level 5 path @home
ID 356 gen 2182 top level 5 path timeshift-btrfs/snapshots/2026-08-12_06-08-42/@home

There is one-to-one correspondence between lines. Running Timeshift in Overay instance in GUI mode I am always prompted for @home recovery ( on demand ) and it works fine along with recovery for instance from $ sudo rm -fr /usr/lib/modules or $ sudo rm -fr /usr/bin, if I will delete some sub-folders under /home/boris ( intentionally in Overlay mode ) . Then Timeshift in GUI mode makes my bad actions reverted back when I boot into main "rw" Sparky Instance.

Fedora Server 44 OverlayFS BTRFS setup (Assisted by Google AI)

 Review 

OverlayFS is primarily used automatically by the system to mount read-only Btrfs system snapshots as writable environments. This allows you to safely boot into a broken system snapshot from GRUB, run tests, or perform a system restoration while keeping the actual snapshot pristine.

Original disk layout

boris@Server44D:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 bf5880ed-22bf-4df2-b8e8-64b8fdc465ae                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       7E26-5D1C                            1014.1M     1% /boot/efi
└─vda2 btrfs              a93f8d3f-daa0-49b0-a00e-82fcdcc76154   65.5G                                                                                                                                              10% /home
                                        /.snapshots
                                        /

$ sudo dnf install btrfs-assistant snapper gawk inotify-tools libdnf5-plugin-actions git make -y
$ sudo dnf install python3-btrfsutil dracut-live -y

========================
Trick Snapper Method
========================
$ sudo umount /.snapshots
$ sudo rmdir    /.snapshots
$ sudo snapper -c root create-config  /
$ sudo mount  /.snapshots

Create the missing directory: 

$ sudo mkdir -p /boot/grub
$ sudo dnf install grub2-tools 

# Fix binary compatibility wrapper

$ sudo ln -sf /usr/bin/grub2-script-check /usr/bin/grub-script-check

$ git clone https://github.com/Antynea/grub-btrfs.git

$ cd grub-btrfs

================

UNDER grub-config

================

$ nano config

GRUB_BTRFS_MKCONFIG="/usr/bin/grub2-mkconfig"

GRUB_BTRFS_GRUB_DIRNAME="/boot/grub2"

GRUB_BTRFS_SCRIPT_CHECK="grub2-script-check"

========================================

# Compile package targets
$ sudo make install 

 

Feel free to compare it with setup of grub-btrfsd service as of  06/09/26 https://lxer.com/module/newswire/view/365461/index.html .  I mean that compilation of required sequences of commands might be different depending on date when you attempt just a basic setup for service mentioned above specifically on Fedora 44. The same applies to the section "DNF5 TRANSACTION SNAPSHOT AUTOMATION ENGINE"

===============================

sudo nano /etc/btrfs-assistant.conf

===============================

[Subvol-Mapping]

root = "snapshots,@,a93f8d3f-daa0-49b0-a00e-82fcdcc76154"

 

[Backup-Mapping]

/ = "@"

================================

sudo nano /etc/snapper/configs/root

================================

SUBVOLUME="/" 

===============================

sudo nano /etc/default/grub-btrfs/config

===============================

GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="'rd.live.overlay.overlayfs=1 rw'"

==============================

$ sudo dracut --add "dmsquash-live overlayfs" --force --no-hostonly --regenerate-all

$ sudo rm -f /boot/grub2/grub-btrfs.new /tmp/grub-btrfs.*

$ sudo /etc/grub.d/41_snapshots-btrfs

$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

$ sudo systemctl daemon-reload

$ sudo systemctl enable --now grub-btrfsd

DNF5 TRANSACTION SNAPSHOT AUTOMATION ENGINE

================================================

sudo mkdir -p /etc/dnf/libdnf5-plugins/actions.d/

sudo nano /etc/dnf/libdnf5-plugins/actions.d/snapper.actions

Append lines

pre_transaction::::/usr/bin/bash /usr/local/bin/dnf5-snapper-helper pre

post_transaction::::/usr/bin/bash /usr/local/bin/dnf5-snapper-helper post

================================================

sudo nano /usr/local/bin/dnf5-snapper-helper

================================================

#!/bin/bash

STATE_FILE="/etc/snapper/configs/root.dnf_pre_id"

 

case "$1" in

    pre)

        # Capture raw snapshot digit without whitespace or newlines

        /usr/bin/snapper -c root create -t pre -p -d "DNF Transaction" -c number | tr -d '\n' > "$STATE_FILE"

        ;;

    post)

        if [ -s "$STATE_FILE" ]; then

            PRE_ID=$(cat "$STATE_FILE")

            /usr/bin/snapper -c root create -t post --pre-num "$PRE_ID" -d "DNF Transaction Complete" -c number

            rm -f "$STATE_FILE"

        fi

        ;;

esac

===============================================

sudo chmod +x /usr/local/bin/dnf5-snapper-helper

 

RW instance to recover via Btrfs-Assistant

 

❯ ssh boris@192.168.0.106
boris@192.168.0.106's password:  
Web console: https://Server44D:9090/ or https://192.168.0.106:9090/

Last login: Thu Aug  6 16:13:49 2026 from 192.168.0.81
boris@Server44D:~$ mount | grep -E 'on / type'
/dev/vda2 on / type btrfs (rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=267,subvol=/snapshots/6/snapshot)

 
boris@Server44D:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0                                                                            
zram0  swap   1     zram0 c17f6e59-5d8d-40b8-aba7-95e143ca5e91                [SWAP]
vda                                                                            
├─vda1 vfat   FAT32       7E26-5D1C                            1014.1M     1% /boot/efi
└─vda2 btrfs              a93f8d3f-daa0-49b0-a00e-82fcdcc76154   65.5G                             10% /home
                                                 /.snapshots
                                                 /run/rootfsbase
                                                 /

============================== 

Main instance report

==============================

boris@Server44D:~$ uname -a
Linux Server44D 7.1.6-201.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Aug  4 00:23:39 UTC 2026 x86_64 GNU/Linux
boris@Server44D:~$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/vda2      btrfs      74G  7.2G   66G  10% /
devtmpfs       devtmpfs  7.5G     0  7.5G   0% /dev
tmpfs          tmpfs     7.6G   12K  7.6G   1% /dev/shm
efivarfs       efivarfs  256K   85K  166K  34% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G  1.5M  3.1G   1% /run
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
none           tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-resolved.service
/dev/vda2      btrfs      74G  7.2G   66G  10% /.snapshots
/dev/vda2      btrfs      74G  7.2G   66G  10% /home
tmpfs          tmpfs     7.6G  4.0K  7.6G   1% /tmp
/dev/vda1      vfat     1022M  7.9M 1015M   1% /boot/efi
tmpfs          tmpfs     1.6G   84K  1.6G   1% /run/user/1000

 
boris@Server44D:~$ sudo .local/bin/btrview  
                a93f8d3f-daa0-49b0-a00e-82fcdcc76154 | 10% full                   
Subvolume Tree:                        Snapshot Tree:                             
<FS_TREE>                              @_backup_2026-08-06T13:23:55.046Z          
├── snapshots on: /.snapshots          ├── snapshot                               
│   ├── snapshot                       │   └── @_backup_2026-08-06T13:32:22.385Z  
│   ├── snapshot                       │       └── snapshot                       
│   ├── snapshot                       │           └── @ on: /                    
│   ├── snapshot                       │               ├── snapshot               
│   ├── snapshot                       │               ├── snapshot               
│   ├── snapshot                       │               └── snapshot               
│   ├── snapshot                       ├── snapshot                               
│   ├── snapshot                       ├── snapshot                               
│   └── snapshot                       ├── snapshot                               
├── @ on: /                            └── snapshot                               
│   ├── portables                      <FS_TREE>                                  
│   └── .snapshots on: /.snapshots     snapshots on: /.snapshots                  
├── @home on: /home                    @home on: /home                            
├── @_backup_2026-08-06T13:23:55.046Z  portables                                  
└── @_backup_2026-08-06T13:32:22.385Z  .snapshots on: /.snapshots  
 

boris@Server44D:~$ sudo btrfs subvolume list /
ID 256 gen 390 top level 5 path snapshots
ID 257 gen 406 top level 5 path @home
ID 258 gen 285 top level 5 path @_backup_2026-08-06T13:23:55.046Z
ID 259 gen 71 top level 268 path var/lib/portables
ID 260 gen 246 top level 268 path .snapshots
ID 261 gen 222 top level 256 path snapshots/1/snapshot
ID 262 gen 242 top level 256 path snapshots/2/snapshot
ID 263 gen 255 top level 256 path snapshots/3/snapshot
ID 264 gen 257 top level 256 path snapshots/4/snapshot
ID 265 gen 282 top level 256 path snapshots/5/snapshot
ID 266 gen 309 top level 5 path @_backup_2026-08-06T13:32:22.385Z
ID 267 gen 364 top level 256 path snapshots/6/snapshot
ID 268 gen 403 top level 5 path @
ID 269 gen 336 top level 256 path snapshots/7/snapshot
ID 270 gen 387 top level 256 path snapshots/8/snapshot
ID 271 gen 389 top level 256 path snapshots/9/snapshot
 

boris@Server44D:~$ findmnt -t btrfs
TARGET    SOURCE                FSTYPE OPTIONS
/         /dev/vda2[/@]         btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=268,subvol=/@
├─/.snapshots
│         /dev/vda2[/snapshots] btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=256,subvol=/snapshots
└─/home   /dev/vda2[/@home]     btrfs  rw,relatime,seclabel,compress=zstd:1,discard=async,space_cache=v2,subvolid=257,subvol=/@home