Building an Indestructible Debian Sandbox on SparkyLinux 8.4 + True OverlayFS (Assisted by Google AI)

 Review

  The holy grail of desktop engineering is a true immutable sandbox: the ability to boot into a historical snapshot, run risky updates or delete critical system binaries, and have those changes vanish into thin air upon a reboot. To solve this, SparkyLinux 8.4 was chosed (the leanest Debian testing base available) to build a 100% contained RAM sandbox from scratch.
This post is an immediate follow up for https://lxer.com/module/newswire/view/366777/index.html 

On Sparky 8.4 up on completion of basic deployment we would have to add two btrfs subvolumes
$ sudo mkdir -p /mnt/btrfs_top
$ sudo mount -o subvolid=5 /dev/vda3 /mnt/btrfs_top
$ sudo btrfs subvolume create /mnt/btrfs_top/@cache
$ sudo btrfs subvolume create /mnt/btrfs_top/@log
$ sudo umount /mnt/btrfs_top
$ sudo rmdir /mnt/btrfs_top

Then add to /etc/fstab two rows
sudo tee -a /etc/fstab << 'EOF'
UUID=BTRFS-UUID  /var/cache     btrfs   subvol=/@cache,defaults 0 0
UUID=BTRFS-UUID  /var/log       btrfs   subvol=/@log,defaults 0 0
EOF

$ sudo systemctl daemon-reload
$ sudo mount -a
==============================================
Phase of Overlay Setup should look as follows
==============================================
$ sudo apt update
$ sudo apt install dracut dracut-core -y

Then update the line starting with "mount -t overlay LiveOS_rootfs" in file /usr/lib/dracut/modules.d/90overlayfs/mount-overlayfs.sh as shown below

if ! strstr "$(cat /proc/mounts)" LiveOS_rootfs; then

      mount -t overlay LiveOS_rootfs -o "$ovlfs",upperdir=/run/overlayfs,workdir=/run/ovlwork "$NEWROOT"

fi
==============================================
Inject the working parameters exclusively into the Snapshot Configuration
$ sudo nano /etc/default/grub-btrfs/config
GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="'rd.live.overlay.overlayfs=1'"

$ echo 'add_dracutmodules+=" overlayfs "' | sudo tee /etc/dracut.conf.d/overlayfs.conf
$ sudo dracut -H --hostonly-mode=sloppy --add overlayfs --force
$ sudo update-grub

 

Overlay instance status

 boris@devs-stable:~$ uname -a
Linux devs-stable 6.12.101+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.101-1 (2026-08-05) x86_64 GNU/Linux
boris@devs-stable:~$ mount | grep 'on / '
LiveOS_rootfs on / type overlay (rw,relatime,lowerdir=/run/rootfsbase,upperdir=/run/overlayfs,workdir=/run/ovlwork,uuid=on)

boris@devs-stable:~$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
LiveOS_rootfs  overlay   3.1G  9.6M  3.1G   1% /run/rootfsbase
devtmpfs       devtmpfs  4.0M     0  4.0M   0% /dev
tmpfs          tmpfs     7.6G   12K  7.6G   1% /dev/shm
efivarfs       efivarfs  256K  138K  114K  55% /sys/firmware/efi/efivars
tmpfs          tmpfs     3.1G  9.6M  3.1G   1% /run
tmpfs          tmpfs     5.0M  8.0K  5.0M   1% /run/lock
tmpfs          tmpfs     7.6G  8.0K  7.6G   1% /tmp
tmpfs          tmpfs     1.0M     0  1.0M   0% /run/credentials/systemd-journald.service
/dev/vda3      btrfs      68G  7.9G   59G  12% /home
/dev/vda3      btrfs      68G  7.9G   59G  12% /var/cache
/dev/vda3      btrfs      68G  7.9G   59G  12% /var/log
/dev/vda2      ext4      2.0G   48M  1.8G   3% /boot
/dev/vda1      vfat      300M   12M  288M   4% /boot/efi
tmpfs          tmpfs     1.6G  112K  1.6G   1% /run/user/1000

boris@devs-stable:~$ lsblk -f
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1 vfat   FAT32       BC5B-499E                             287.8M     4% /boot/efi
├─vda2 ext4   1.0         47eb48b0-7552-4db8-a77a-ce37c5fa83e4    1.7G     2% /boot
└─vda3 btrfs              0ef48971-0c2d-4498-a2cb-b0ad655ac160   58.3G    12% /var/log
                                                                              /var/cache
                                                                              /home
                                                                              /run/rootfsbase