Mount options control how a filesystem behaves: whether reading a file triggers a write, whether programs may run from it, and what happens if a disk is missing at boot. A few well-chosen options improve performance, security and reliability. They’re set in /etc/fstab, or with mount -o.

Basics: fstab guide and mount command.

See current options

findmnt -o TARGET,SOURCE,FSTYPE,OPTIONS
findmnt /
mount | grep ' / '

Access time: atime, relatime, noatime

Linux can record the last access time of every file. Updating it turns reads into writes.

Option Behaviour
atime Update on every access (expensive; rarely used)
relatime Update only if older than the modification time, or more than 24 h old. The default
noatime Never update access times
nodiratime Directories only (implied by noatime)

relatime already removes most of the overhead. noatime is a small additional gain for read-heavy workloads: web servers, caches, mail stores. Very few programs depend on access times (some mail readers, tmpwatch-style cleaners).

UUID=…  /var/www  ext4  defaults,noatime  0 2

Security options

Option Prevents
noexec Executing binaries from this filesystem
nosuid setuid/setgid bits taking effect
nodev Device files being interpreted

Common hardening for /tmp, /var/tmp and /dev/shm (where attackers like to drop files), and for data or upload partitions:

tmpfs  /tmp      tmpfs  defaults,noexec,nosuid,nodev,size=1G  0 0
tmpfs  /dev/shm  tmpfs  defaults,noexec,nosuid,nodev          0 0

Test afterwards. Some installers and tools execute from /tmp, and fail with noexec. noexec doesn’t stop interpreted scripts run explicitly (bash /tmp/x.sh). It’s one layer, not a complete defence. See Linux /tmp cleanup and Linux server hardening checklist.

Reliability options

Option Use
nofail Don’t fail the boot if this device is missing (extra disks, USB, network shares)
x-systemd.device-timeout=10s Wait at most 10 s for the device
_netdev Network filesystem: mount after the network is up (NFS, CIFS, iSCSI)
x-systemd.automount Mount on first access instead of at boot
ro Read-only
errors=remount-ro ext4: remount read-only on errors (Debian/Ubuntu default for /)

A missing data disk without nofail can drop the server into emergency mode at boot. Then you need the VNC console to fix it. See VPS VNC console.

UUID=…  /data  xfs  defaults,noatime,nofail,x-systemd.device-timeout=10s  0 2

Filesystem-specific options

  • ext4: commit=60 (journal commit interval; longer = fewer writes, more data loss risk on crash), data=ordered (default).
  • XFS: usually best with defaults (plus noatime).
  • Btrfs: compress=zstd:3, space_cache=v2, discard=async.

See ext4 vs XFS and TRIM.

Apply changes safely

sudo cp /etc/fstab /etc/fstab.bak
sudo nano /etc/fstab
sudo findmnt --verify            # syntax and sanity check
sudo systemctl daemon-reload
sudo mount -o remount /var/www   # apply new options to a mounted filesystem
findmnt /var/www

mount -a mounts anything not yet mounted. Run it, together with findmnt --verify, before rebooting, so mistakes show up while you can still fix them.

Quick reference

Goal Option
Fewer writes on reads noatime (default relatime is fine too)
Block executables noexec,nosuid,nodev
Don’t block boot nofail (+ device timeout)
Network shares _netdev
Check fstab findmnt --verify
Apply live mount -o remount <mountpoint>

Related: Linux device files and LVM guide.

  • Linux
  • Filesystem
  • Performance