k3os overlayFS host directory exposure through misconfigured mounts

k3os deploys a read-only root filesystem mounted through initramfs to safeguard base OS binaries from unintended writes. The overlayFS configuration option, when present in the k3os definition, permits administrators to designate specific directories as writable while preserving the immutability of the core root. This design prevents accidental host service exposure in typical container workloads, yet the interaction between overlay layer path mappings and container runtime port handling introduces configuration points where a mis-specified mount can inadvertently grant host-level accessibility. Services requiring write access, such as logging or stateful data directories, must be assigned dedicated writable mounts or data directories; otherwise they may fall back to the read-only root or trigger fallback behaviors. The extent to which overlayFS path mappings translate to host-visible directories depends on the exact mount syntax and the container runtime's namespace isolation settings.

Under what overlayFS path mapping configuration does a host directory become accessible from the booted k3os environment? How does the containerd integration enforce port isolation when the root filesystem remains read-only? What is the minimal writable mount specification required for system logging without compromising the read-only root integrity?