https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt has a chapter Metadata only copy up:
When metadata only copy up feature is enabled, overlayfs will only copy up metadata (as opposed to whole file), when a metadata specific operation like chown/chmod is performed. Full file will be copied up later when file is opened for WRITE operation.
In other words, this is delayed data copy up operation and data is copied up when there is a need to actually modify data.
There are multiple ways to enable/disable this feature.
[…]
That feature would be useful for Whonix-Host. If anyone already used that, please help in ⚓ T914 Whonix Host Live - enable KVM readonly mode - virt-xml vm-name --edit --disk readonly=on.