How containers work: overlayfs