Summary
Since T5003 (VyOS 1.4), the generated /etc/containers/storage.conf always sets mount_program = "/usr/bin/fuse-overlayfs". That was needed for live-booted systems, where the container storage sits on the root overlayfs and podman refuses native overlay on top of it. Installed systems keep the storage on the ext4 persistence partition, so they don't need it. They still run one fuse-overlayfs userspace process per container and pay a FUSE round trip on every file operation, which hurts I/O-heavy containers like databases.
Additional information
mount_program is only rendered when the podman graphroot sits on overlayfs (live boot). Otherwise podman uses the kernel overlay driver.
*Existing installations:*
Nothing changes automatically. containers/storage writes <graphroot>/overlay/.has-mount-program when it runs with a mount program. It keeps using fuse-overlayfs while that file exists, even with mount_program removed from the config. This is intended: layers written by fuse-overlayfs store whiteouts in a format the kernel overlay doesn't understand, so the file must not be deleted by hand.
*Switching an existing system to kernel overlayfs (optional)*
This removes all images and container storage. Host-path volumes are kept; anonymous podman volumes are lost.
- Stop all containers: sudo systemctl stop vyos-container-<name>
- Reset the storage: sudo podman system reset --force
- Re-pull every image: add container image <image>
- Restart the containers: restart container <name>
Check that pgrep fuse-overlayfs prints nothing.
On an installed router with three containers (AdGuard Home, FreeRADIUS, MongoDB), all three came up on kernel overlay after the reset. No fuse-overlayfs processes were left.