Living the bifurcated life in macOS Catalina

If you're a macOS Catalina user, and a user of Terminal for various tasks, you might be surprised at how some things work—or rather, don't work, in Catalina. As a first example, consider the Utilities folder…on the left is how it appears in Finder, and on the right, the contents of that same folder listed in Terminal:

While Finder shows a full Utilities folder, Terminal shows it as empty. Why? If you're somewhat familiar with the technical side of macOS Catalina, you probably know the answer: Apple has separated much of the OS and placed it on a read-only volume.

Apple's "About the read-only system volume in macOS Catalina" page explains things fairly well—basically, what you see as one Utilities folder in Finder is really two things: A read-only Utilities folder, and a user-writable Utilities folder. (If my machine had any user-installed apps in the Utilities folder, they would have shown up in the Terminal output above.)

In normal use, this split is a good thing (much better security), and you won't ever notice the differences. But in Terminal, well, things are different, because there's no magic to show you the combined views, so you may find results that don't match what your intuition says you should see.

Instead of trying to explain this in detail here, I'll just point you Howard Oakley's great article that includes a couple of PDFs showing the layout of both the reserved System volume and the Data volume.

From that article, this quote is a good summary:

The old folder containing main apps, which used to be /Applications, now contains a mixture of apps from two different folders, /System/Applications, which is on the System volume and contains Apple’s bundled apps, and the Applications folder on the Data volume, which would otherwise be found at /System/Volumes/Data/Applications. When you install your own apps, they automatically get placed in the latter folder, as it’s the one which you can write to. When you view the /Applications folder in the Finder, though, you are actually seeing the combined contents of both folders, an illusion which is created by the firmlink at /Applications and the Finder.

The key to making all of this are firmlinks, which as the name implies, are something between soft links and a hard links. They can only exist for directories, and they're created at installation time. Here's how Apple described them in the Filesystem WWDC Session in 2019:

Firmlinks: Bi-directional wormhole in path traversal. New filesystem object, similar to symlink.

• Consistent forward and backward traversal of the file name space
• Only for directories
• Created on the system volume at installation time
• Not expected to be noticed by a user or an application

You might also find this article by Bombich Software (makers of Carbon Copy Cloner) useful for understanding what's going on.

The end result of the disk structure and firmlinks is that you (hopefully) don't have to care about how things are actually arranged. For example, scripts that store things in /usr/local/bin will continue to work, even though that path is technically on the non-writable system volume.

It's a strange new world…