Can the root filesystem be unmounted in Linux?

Question

I am not talking about rootfs here. If there is only one process running in Linux and its working directory is /, then can it be unmounted? Will rootfs be what is left over? If it cannot be unmounted, then can the filesystem with type rootfs be mounted?

Answer 1

First, you'll need to know what the rootfs actually is.

From the documentation of Linux kernel source code:

What is rootfs?

Rootfs is a special instance of ramfs (or tmpfs, if that's enabled), which is always present in 2.6 systems. You can't unmount rootfs for approximately the same reason you can't kill the init process; rather than having special code to check for and handle an empty list, it's smaller and simpler for the kernel to just make sure certain lists can't become empty.

Most systems just mount another filesystem over rootfs and ignore it. The amount of space an empty instance of ramfs takes up is tiny.

If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by default. To force ramfs, add "rootfstype=ramfs" to the kernel command line.

So, rootfs is not a real filesystem type: it may initially be an instance of either ramfs or tmpfs depending on kernel configuration. But once initramfs has done its job, rootfs essentially becomes a dummy placeholder that ensures that the kernel's list of mounted filesystems is never totally empty, to avoid the requirement to have special-case code to handle that situation.

Normally you cannot just unmount the real root filesystem; if you could do that, you would end up with a situation where you have no way to open any files (and no existing files open, because having any files open in the old root filesystem would prevent its unmounting). At that point, you won't be able to load any new executables. Since there would be no place where /dev, /proc or /sys would mount onto, you won't be able to access most devices either. So a system with the root filesystem unmounted is not very useful, other than as a final step before reboot or shutdown.

The real way to switch from one root filesystem to another (e.g. from the boot-time initramfs to the real root filesystem) is using the pivot_root(2) system call.

There is also a command-line tool switch_root(8) but it is designed to be used specifically in the transition from initramfs to the real root filesystem only:

WARNING: switch_root removes recursively all files and directories on the current root filesystem.

This is what allows the initramfs to become empty and shrink to insignificance when the system transitions from initramfs to the real root filesystem at boot time. But trying to use switch_root to transition from one real root filesystem to something else would cause the contents of the old root filesystem to be deleted, so it's not useful for non-destructively transitioning from one disk-based root filesystem to another.

Before the 2.6.xx kernels, I think someone made a proof-of-concept Linux firewall that just set up the network interfaces, routing and ipchains/iptables firewalling, and then just halted the kernel. Back then halting just meant stopping the user-space processes and the kernel kept running. I think this was more of an interesting stunt / conversation piece than a serious design for anything. But the only things you could do with a root filesystem unmounted would probably be something along those lines.