8.1.2 Runtime Layer Writes

Runtime layer writes are the ongoing filesystem modifications an application makes to its container's writable layer while it runs, encompassing everything from log files and temporary data to application state changes, all subject to the writable layer's fundamentally ephemeral nature.

What Typically Gets Written During Normal Operation

A running application commonly writes log files, temporary processing files, cached data, and potentially application-specific state, all of which land in the container's writable layer unless explicitly redirected elsewhere.

docker exec myapp ls -la /var/log/myapp/
docker diff myapp | head -20

This reveals the accumulating set of changes a running application has made to its container's writable layer over time.

Why Unbounded Runtime Writes Can Become a Problem

Without any limit or periodic cleanup, an application that continuously writes data — particularly logs or temporary files that aren't ever cleaned up — can cause the writable layer to grow indefinitely, eventually consuming significant disk space.

docker exec myapp du -sh /var/log

Monitoring this kind of accumulation helps catch a growing problem before it becomes severe.

Redirecting High-Volume Writes Away From the Writable Layer

For applications generating substantial volumes of data through their normal operation, redirecting that output to a mounted volume avoids burdening the container's own storage driver with this potentially large and ongoing volume of writes.

docker run -d -v myapp-logs:/var/log/myapp myapp:1.0

Why Considering Runtime Layer Writes Matters

Being mindful of what a running application actually writes to its container's writable layer — and redirecting genuinely high-volume or important data to a volume — helps avoid both unexpected disk consumption and the specific risk of losing important data that was never actually backed by anything beyond the container's own ephemeral writable layer.