A read-only tag-filesystem overlay for hierarchical filesystems