> If you use docker (which uses overlay2) for every application you can easily track these changes No: it can only create a serialized sequence of changes that

> If you use docker (which uses overlay2) for every application you can easily track these changes No: it can only create a serialized sequence of changes that cannot be reordered. Also it's not aware of the context and meaning of a change. > That said, yes, something like that would be great. Using overlay + namespaces/cgroups could get us close to that. Then we'd have to detect which packages are completely passive (read only, shared dependency of many others) which are shared but have their own state, which are shared but their state is a mix of per-dependant states (so if multiple packages/apps depend on a DB service then the schemas/tables ought to be isolated), and so on. apt-get based distribution already track which files and directories are related to which package. Also systemd unit files already can ensure that daemons are not making changes elsewhere. Indeed, what's missing is tracking dependencies across applications and across hosts. Linux distributions got most of it right decades ago (before the container dumpster fire)