fstab entries that are not disks - bind mounts, tmpfs, and swap · Linux

Three kinds of fstab entry have no block device behind them. A bind mount re-attaches a directory that is already mounted. A tmpfs mount is memory pretending to be a filesystem. A swap entry is not a mount at all - swapon reads it, not mount.

None of them can fail with “device not found”, which is why they tend to be written casually. Each has a failure the disk-backed entries do not.

Bind mounts

A bind mount attaches an existing directory at a second path. The kernel keeps no record that it was a bind - man 8 mount is explicit that “bind” is just another way to attach a filesystem, with no second-class node created. Two paths, one filesystem, one set of inodes.

Read-only / Safea bind mount in fstab— The device column is the source directory. The type column is 'none' because there is no filesystem type to name - the filesystem is already mounted somewhere else. The 'bind' option is what makes it a bind rather than an attempt to mount a directory as a device. Pass is 0: fsck has nothing to check, the underlying filesystem is checked through its own entry.

$ grep -n bind /etc/fstab

/srv/data/exports  /export/data  none  bind  0 0

The common uses are all about presenting the same data under a path something else insists on: an NFS export root, a chroot or container root, a service that hard-codes /var/lib/<name> when the data lives on a separate volume.

A read-only bind takes two lines

This is the detail that catches people. The bind flag and the read-only flag are set by different mechanisms, and the classic mount(2) call cannot do both at once.

/srv/data/exports  /export/data  none  bind             0 0
/srv/data/exports  /export/data  none  remount,bind,ro  0 0

Two entries for the same mount point: the first creates the bind, the second remounts it read-only. man 8 mount documents this as the classic way, and notes that the remount,bind form is still honoured when it comes from /etc/fstab.

Since util-linux 2.27 a single -o bind,ro also works from the command line, but it is implemented in userspace as an extra remount syscall - the man page states plainly that the solution is not atomic. Since util-linux 2.39 with the new kernel mount API the single-step form behaves properly. Check what you have before relying on the short form:

Read-only / Safewhich mount semantics you have— The util-linux version decides whether a one-step read-only bind is reliable. Below 2.39 the two-line fstab idiom is the portable answer, and it is correct on every version, so there is little reason to write anything else in a file that has to work on a mixed fleet.

$ mount --version

mount from util-linux 2.41.3 (libmount 2.41.3: selinux, smack, btrfs, verity, namespaces, idmapping, statmount, statx, assert, debug)

`bind` stops at the mount boundary

A bind mount attaches one filesystem. If the source directory has other filesystems mounted underneath it, they do not come along.

Read-only / Safethe submount that did not come along— /var/log is its own filesystem. A plain bind of /var to /export/var carries only the vg0-var filesystem, so /export/var/log is an empty directory - the one that exists on vg0-var underneath the vg0-varlog mount. Nothing errors. The backup that reads /export/var simply contains no logs. Use --rbind, or 'rbind' in the options column, to carry submounts recursively.

$ findmnt -o TARGET,SOURCE,FSTYPE /var /var/log /export/var

TARGET      SOURCE                  FSTYPE
/var        /dev/mapper/vg0-var     ext4
/var/log    /dev/mapper/vg0-varlog  ext4
/export/var /dev/mapper/vg0-var[/]  ext4

Illustrative output

The failure is silent and it is usually discovered during a restore. Use rbind when the source has submounts, and check with findmnt rather than ls - an empty directory and a missing filesystem look identical to ls.

Ordering a bind mount

A bind mount cannot succeed before its source is mounted. Say so explicitly rather than hoping the path nesting works out:

/srv/data/exports  /export/data  none  bind,x-systemd.requires-mounts-for=/srv/data  0 0

x-systemd.requires-mounts-for= adds a RequiresMountsFor= to the generated unit, which makes systemd order this mount after whatever filesystem provides /srv/data and fail it cleanly if that filesystem is absent. Without it, the failure mode is worse than a failed mount: the bind can succeed against the empty directory that exists at /srv/data before its real filesystem is mounted, and you get an export of nothing.

tmpfs

tmpfs is memory presented as a filesystem. Pages are freed when files are deleted, and they can be pushed to swap under pressure. Its contents do not survive a reboot, which is the point, and also the thing somebody eventually forgets.

Read-only / Safea sized tmpfs— The device column for tmpfs is conventionally the word tmpfs; it is a label, not a device, and any string works. size=2G caps it. nr_inodes caps the file count, which matters because a tmpfs filled with empty files exhausts inodes long before it exhausts bytes. nosuid,nodev,noexec is the standard hardening set for a cache directory nothing should execute from.

$ grep tmpfs /etc/fstab; findmnt -t tmpfs -o TARGET,SIZE,USED,AVAIL,OPTIONS

tmpfs /var/cache/app tmpfs rw,nosuid,nodev,noexec,size=2G,nr_inodes=200k,mode=1777 0 0
TARGET          SIZE  USED AVAIL OPTIONS
/dev/shm       15.6G     0 15.6G rw,nosuid,nodev,inode64
/run            3.2G  2.1M 3.2G rw,nosuid,nodev,mode=755,inode64
/var/cache/app    2G  418M 1.6G rw,nosuid,nodev,noexec,size=2G,nr_inodes=200k,mode=1777

Illustrative output

The tmpfs default is 50% of RAM, and it is charged to RAM

man 5 tmpfs states that when neither size nor nr_blocks is given, the default is size=50%. On a 512 GB host that is a 256 GB /tmp - and every byte written into it is a byte of memory the kernel cannot give to anything else.

The failure is not ENOSPC. A process filling an unsized tmpfs consumes memory until the machine swaps, then thrashes, then the OOM killer picks a victim, and the victim is chosen by oom_score rather than by who caused the problem. The database dies; the log-rotation script that wrote 200 GB into /tmp survives.

Always write an explicit size=. Size it as a memory allocation, because that is what it is:

findmnt -t tmpfs -o TARGET,SIZE,USED,OPTIONS
free -h

noswap (Linux 6.4 and later) pins a tmpfs to RAM only, which is right for sensitive scratch data and wrong for anything large - it removes the pressure valve.

Note that /tmp, /run and /dev/shm are usually mounted by systemd or the initramfs, not by your fstab. Adding your own /tmp entry overrides systemd’s tmp.mount, which is a legitimate thing to do and also a change worth making deliberately:

systemctl cat tmp.mount
systemctl is-enabled tmp.mount

Swap

A swap entry is read by swapon -a, not by mount. The mount point column is none (or swap, which is equally ignored), and the options column carries swap options rather than mount options.

Read-only / Safeswap in fstab and in the kernel— swapon --show is the authoritative view: what is actually active, its size, how much is in use, and its priority. PRIO is where the two entries differ - the swap file was given pri=10 so it is used before the partition at -2. Negative priorities are what the kernel assigns automatically when none is given. Equal priorities are striped across; different priorities are used in descending order.

$ swapon --show; grep swap /etc/fstab

NAME       TYPE      SIZE USED PRIO
/dev/dm-1  partition   8G 512M   -2
/swapfile  file        4G   0B   10
UUID=b4f0e2a1-8c3d-4e5f-9a01-2b3c4d5e6f70 none swap sw,nofail 0 0
/swapfile none swap sw,pri=10,nofail 0 0

Illustrative output

The options recognised here come from man 8 swapon:

Option	Effect
`sw`	Legacy no-op kept for compatibility; harmless and conventional
`pri=N`	Priority 0-32767; higher is used first
`discard`, `discard=once`, `discard=pages`	Issue TRIM to the backing device
`nofail`	Do not fail the boot if this swap area is missing
`noauto`	Do not activate with `swapon -a`

mkswap gives the area a new UUID, and fstab still names the old one

The sequence that breaks a boot: the swap partition is reinitialised - to change its size, to enable a discard policy, to clear a corrupt signature - with

sudo mkswap /dev/vg0/swap

mkswap writes a fresh header with a new UUID. The fstab entry still carries the old one. swapon -a cannot find it, and without nofail the generated swap unit fails, swap.target fails, and the boot can land in emergency mode over a filesystem that holds no data at all.

Re-read the UUID and update fstab in the same change, then prove it before rebooting:

sudo blkid -t TYPE=swap -o export
sudo swapon -a --verbose
swapon --show

nofail belongs on essentially every swap entry. Swap is a performance facility, not a correctness one; a host that boots without it is degraded, and a host that does not boot is down.

What the generator makes of these three

systemd-fstab-generator produces a different unit type for each, and knowing which one to ask about is most of the troubleshooting:

Bind - a normal .mount unit. systemctl cat export-data.mount shows What=/srv/data/exports and Options=bind. It is ordered by RequiresMountsFor=, which comes from the path nesting and from any x-systemd.requires-mounts-for= you wrote.
tmpfs - also a .mount unit, with What=tmpfs. Because there is no device, there is no .device unit, so x-systemd.device-timeout= does nothing here.
Swap - a .swap unit, named after the device path: /swapfile becomes swapfile.swap, and /dev/dm-1 becomes dev-dm\x2d1.swap. It is pulled in by swap.target, not by local-fs.target.

systemctl list-units --type=mount --type=swap
systemctl status swapfile.swap
systemctl list-dependencies swap.target

A failure in any of the three surfaces as a failed unit, and systemctl --failed names it before you have read a line of fstab.

Bind mounts

A read-only bind takes two lines

bind stops at the mount boundary

Ordering a bind mount

tmpfs

Swap

Knowledge check

`bind` stops at the mount boundary