:py:mod:`dissect.target.filesystems.overlay`
============================================

.. py:module:: dissect.target.filesystems.overlay




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.filesystems.overlay.Overlay2Filesystem
   dissect.target.filesystems.overlay.OverlayFilesystem



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.target.filesystems.overlay.oci_layers



Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.filesystems.overlay.log


.. py:data:: log

.. py:class:: Overlay2Filesystem(path: pathlib.Path, *args, **kwargs)

   Bases: :py:obj:`dissect.target.filesystem.LayerFilesystem`


   Docker Overlay 2 filesystem implementation.

   Deleted files will be present on the reconstructed filesystem.
   Volumes and bind mounts will be added to their respective mount locations.
   Does not support tmpfs mounts.

   .. rubric:: References

   - https://docs.docker.com/engine/storage/drivers/overlayfs-driver/
   - https://docs.docker.com/storage/storagedriver/
   - https://docs.docker.com/storage/volumes/
   - https://www.didactic-security.com/resources/docker-forensics.pdf
   - https://www.didactic-security.com/resources/docker-forensics-cheatsheet.pdf
   - https://github.com/google/docker-explorer


   .. py:attribute:: __type__
      :value: 'overlay2'


      A short string identifying the type of filesystem.


   .. py:attribute:: base_path


   .. py:method:: __repr__() -> str


.. py:class:: OverlayFilesystem(path: pathlib.Path, *args, **kwargs)

   Bases: :py:obj:`dissect.target.filesystem.LayerFilesystem`


   Podman overlay filesystem implementation.

   Currently does not support mounting of (anonymous) volumes, named volumes and bind mounts.
   Also does not map mount point files, hosts, hostname and resolv.conf files.

   .. rubric:: References

   - https://github.com/containers/podman
   - https://docs.podman.io/en/latest/


   .. py:attribute:: __type__
      :value: 'overlay'


      A short string identifying the type of filesystem.


   .. py:attribute:: base_path


   .. py:method:: __repr__() -> str


.. py:function:: oci_layers(path: pathlib.Path) -> collections.abc.Iterator[tuple[str, pathlib.Path]]

   Yield the layers of an OCI container provided the ``mount_path``.