Filesystems

Filesystems#

A comparison of the filesystems an operator is most likely to encounter on Linux, Unix, macOS, Windows, and embedded systems. Picking one is mostly about the workload (database vs. media vs. boot vs. removable) and the tooling that has to read it.

Linux Native#

The filesystems an operator picks from when formatting a Linux volume. ext4 is the safe default; XFS is preferred for big files and high throughput; Btrfs and ZFS bring snapshots and CoW; F2FS is the right pick for flash media like SD cards and eMMC.

Filesystem	Max file	Max volume	Journaling	CoW / snap	Notes
ext4	16 TiB	1 EiB	Yes	No / No	The Linux default; mature, stable, fast.
ext3	2 TiB	16 TiB	Yes	No / No	ext4’s predecessor; only on legacy systems.
ext2	2 TiB	16 TiB	No	No / No	No journal; fine for small / read-only / EFI.
XFS	8 EiB	8 EiB	Yes	No / No	High-throughput; common on RHEL; good for big files.
Btrfs	16 EiB	16 EiB	CoW	Yes / Yes	Snapshots, subvolumes, RAID; default on Fedora.
ZFS (Linux)	16 EiB	256 ZiB	CoW	Yes / Yes	Pool-based; checksums; via OpenZFS module.
F2FS	4 TiB	16 TiB	Yes	No / No	Flash-friendly; SD cards, eMMC, Android.
ReiserFS	8 TiB	16 TiB	Yes	No / No	Legacy; do not use for new installs.
JFS	4 PiB	32 PiB	Yes	No / No	IBM’s; reliable; rarely chosen today.
NILFS2	8 EiB	8 EiB	CoW	Yes / Yes	Continuous snapshots; niche.

macOS / BSD / Solaris#

The non-Linux Unix filesystems an operator may meet. APFS is what modern Macs ship; ZFS is native on FreeBSD / illumos and the benchmark for snapshot / checksum semantics; UFS is the historical BSD default.

Filesystem	Max file	Max volume	Journaling	CoW / snap	Notes
APFS	8 EiB	8 EiB	Yes	Yes / Yes	macOS / iOS / iPadOS default since 2017.
HFS+	8 EiB	8 EiB	Yes	No / No	Older macOS default; still supported read-only.
ZFS	16 EiB	256 ZiB	CoW	Yes / Yes	Native on FreeBSD, Solaris, illumos.
UFS / UFS2	8 ZiB	8 ZiB	Soft updates	No / Snap	FreeBSD default; classic BSD filesystem.

Windows#

The Windows filesystems most operators encounter on cross-platform work. NTFS is the desktop / server default; ReFS is the modern Storage-Spaces backing; exFAT and FAT32 are the removable-media options that need to interchange with non- Windows hosts.

Filesystem	Max file	Max volume	Journaling	CoW / snap	Notes
NTFS	16 EiB	8 PiB	Yes	No / VSS	Windows default; Linux read-write via ntfs-3g.
ReFS	~35 PB	~35 PB	Yes	Yes / Yes	Resilient FS; Windows Server, Storage Spaces.
exFAT	16 EiB	128 PiB	No	No / No	Cross-platform USB / SD; no journal.
FAT32	4 GiB	2 TiB	No	No / No	Universal but capped; EFI partitions, USB.

Network and Distributed#

Filesystems backed by remote storage. NFS for the Unix world; SMB / CIFS for Windows shares; SSHFS for ad-hoc remote-mount work; CephFS / GlusterFS / Lustre / GPFS for cluster-scale storage; the S3 mounters for “treat object storage as a filesystem.”

Filesystem	Notes
NFS	Network FS; the Unix standard; v3 and v4 common.
SMB / CIFS	Windows file sharing; Linux via Samba / cifs-utils.
AFS	Andrew File System; mature, niche today.
SSHFS	Mount over SSH; userland (FUSE).
CephFS	Ceph’s distributed POSIX filesystem.
GlusterFS	Distributed; less common in 2026.
Lustre	HPC clusters.
GPFS / Spectrum Scale	IBM; HPC and large-scale storage.
HDFS	Hadoop Distributed File System; legacy big-data.
S3FS / goofys / mountpoint-s3	Mount object storage as a filesystem.
9P	Plan 9; used by virtio in QEMU and WSL.

Pseudo / Virtual#

Filesystems that don’t back any storage, they expose kernel state, RAM, or layered images as a tree of files. proc and sysfs are the kernel introspection interfaces; tmpfs backs /tmp and /run; overlay is the basis of every container image.

Filesystem	Purpose
tmpfs	RAM-backed; `/tmp`, `/run`, `/dev/shm`.
ramfs	Like tmpfs but unbounded; rarely used directly.
proc	Kernel state per process and globally.
sysfs	Devices, drivers, and kernel internals.
cgroup, cgroup2	Resource control hierarchies.
devtmpfs	Device nodes auto-populated by the kernel.
debugfs	Kernel debugging interfaces.
tracefs	Kernel tracing (ftrace).
configfs	User-driven kernel object configuration.
fuse	Userspace filesystem framework.
overlay	Layered union FS; the basis of container images.
squashfs	Read-only compressed; live ISOs, embedded.

Encryption Layers#

The four encryption tiers that sit at or above the filesystem layer. LUKS / dm-crypt encrypt the block device; fscrypt encrypts at the filesystem layer; eCryptfs is the older per-file overlay; ZFS native encryption is built into the pool itself.

Layer	Notes
LUKS / dm-crypt	Block-level encryption under any FS.
fscrypt	ext4 / F2FS / UBIFS native encryption (per-directory).
eCryptfs	Per-file overlay encryption (older Ubuntu home-encrypt).
EncFS	FUSE-based per-file encryption (security caveats).
gocryptfs	Modern FUSE-based encrypted FS.
BitLocker	Windows full-volume encryption.
FileVault	macOS full-volume encryption (APFS-native).

Choosing#

The decision tree as a flat table, pick the row that matches the workload, the column tells you the right filesystem. Most operator decisions land in the first half (general server, containers, snapshots, database, embedded) and don’t need to look further.

Workload	Pick
General Linux server Containers / podman / docker overlay (the runtime picks); ext4 / XFS underneath	ext4 (safe default) or XFS (large files)
Snapshots / send-receive	Btrfs or ZFS
Database storage	XFS or ext4 with appropriate tuning
HPC / scientific big files	XFS, Lustre, GPFS, BeeGFS
Boot / EFI partition	FAT32 (EFI requires it)
USB stick / SD card Removable drive (Linux ↔ Win) exFAT	exFAT (cross-platform), F2FS (Linux only)
Embedded / IoT	F2FS, JFFS2, UBIFS, squashfs
Read-only ISO / appliance	squashfs or iso9660
Cross-platform desktop	APFS (macOS), NTFS (Windows), ext4 (Linux)
Network share (Unix)	NFS
Network share (Windows)	SMB / CIFS
Object storage as POSIX	mountpoint-s3 (read-mostly), goofys

Inspecting#

The on-host commands for “what filesystem is this and what’s its state.” df -hT and lsblk -f cover most cases; tune2fs / xfs_info / btrfs filesystem show / zpool status go deeper into the per-filesystem details.

$ df -hT
$ mount
$ findmnt
$ lsblk -f
$ blkid
$ stat -f /
$ tune2fs -l /dev/sda1
$ xfs_info /
$ btrfs filesystem show
$ zfs list / zpool status

Quick Reference: Mount Options#

The mount options that come up most in /etc/fstab review. The security-flavored ones (noexec, nosuid, nodev) are hardening defaults for untrusted mounts; noatime is the read-performance shortcut; compress=zstd and discard matter on Btrfs / F2FS and SSDs respectively.

Option	Effect
`ro` / `rw`	read-only / read-write
`noexec`	block executing files
`nosuid`	ignore setuid / setgid bits
`nodev`	no device-special-file interpretation
`relatime`	update atime only on mtime/ctime change (default)
`noatime`	never update atime (read performance)
`sync` / `async`	synchronous vs. async writes
`defaults`	`rw,suid,dev,exec,auto,nouser,async`
`user`	allow non-root mount
`bind`	bind-mount one tree to another
`loop`	mount a file as a block device
`compress=zstd`	Btrfs / F2FS compression
`discard`	online TRIM for SSDs (modern alternative: `fstrim`)

Worth Knowing#

A handful of operational details that are not in the man pages but bite when missed: prefer UUIDs in fstab so cabling changes don’t strand boot; use fstrim instead of the discard option; reflinks turn copy operations into instant metadata work on the right filesystems.

fstab UUIDs, prefer UUID= over /dev/sda1 so cabling changes don’t break mounts (blkid to find the UUID).
TRIM, on SSDs, run fstrim -av weekly via systemd timer rather than discard mount option (less write amplification).
Resizing, most modern Linux filesystems can grow online; only ext-family can shrink, and only when unmounted.
fsck on boot, determined by the 6th column of /etc/fstab; set to 0 for non-rotating disks where you don’t want delays.
Reflinks, Btrfs / XFS / APFS / ZFS support copy-on-write file copies; cp --reflink=auto makes them when possible.