mount.composefs(1)(composefs)

💖 mount.composefs — bestie, let's mount a composefs image 💖

okay so this is the mount.composefs(1) page from the composefs manual, and it's literally gonna be your new fave. sit down, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

mount.composefs — mount a composefs filesystem image 🦋

---

✨ SYNOPSIS ✨

mount.composefs [-o OPTIONS] IMAGE TARGETDIR

---

✨ DESCRIPTION ✨

so the tea is: the composefs project uses an EROFS image file to store metadata, plus one or more separate directories that hold the content-addressed backing data for regular files. like, metadata in one place, actual file contents in another. it's giving organized. 💅

mount.composefs mounts one of those EROFS files, combined with a given set of basedir, at the location you pick. you can call it directly, or you can be all sneaky and let it act as a mount helper by running mount -t composefs .... either way, she ate. 👑

---

✨ OPTIONS ✨

first things first, bestie: the IMAGE argument you pass in must be a valid composefs (EROFS) metadata image, no exceptions. and the TARGETDIR is what gets used as the mount target. 🎯

when you pass stuff through the -o OPTIONS argument, mount.composefs accepts the following options, all colon-separated. yes, colons. iykyk.

• basedir=PATH — this path is used to resolve the non-empty file references that are stored in the composefs metadata image. the big main-character use case here is making it the exact same path you handed to mkcomposefs --digest-store=PATH. and guess what? you can specify multiple paths, separated by :. slay. 🎀
• digest=DIGEST — the image file gets validated to have the specified fs-verity digest before it's ever used. this is what gives you a whole chain of trust, so that only the expected data is ever visible in the mount. lowkey iconic. this option also implies verity.
• idmap=PATH — specify a path to a user namespace whose ID mapping should be used. the typical format for this kind of path is /proc/<pid>/ns/user 🫶
• verity — if this is specified, all files in the IMAGE must specify an fs-verity digest, and all the files in the base dirs must have a matching fs-verity digest. no cap.

note: this needs support for the overlayfs "verity" option in the kernel, which was added in 6.6rc1. so check your kernel bestie, don't come crying to me 😭

• ro — mounts the filesystem read-only. this is mainly useful when you're using upperdir, since unlayered composefs images are naturally readonly anyway. 💀
• rw — overrides a previous ro option. plot twist!
• upperdir — specify an upper dir in the overlayfs mount that composefs uses. this lets you have a writable layer sitting on top of the composefs image. see the overlayfs docs for details, i'm not gonna gatekeep. 📚
• workdir — specifies an overlayfs workdir to go with upperdir. they're a package deal, fr fr. 💜

---

✨ SEE ALSO ✨

• composefs-info(1)
• mount.composefs(1)
• composefs upstream ⟨https://github.com/containers/composefs⟩ 🌈

---

and that's the whole page, periodt. 💅 this was the User source, mount.composefs(1) in the composefs manual, and the date slot on this one is just chilling as a lil blank — so no date drama here. go mount something gorgeous, bestie. mwah. 😘 ✨🎀🦋💖