A copy-on-write union filesystem. A computer system identifies a first filesystem namespace as a mutable layer, and a second filesystem namespace as an immutable layer. The computer system exposes a merged filesystem namespace as a union filesystem that merges the mutable layer and the immutable layer, and that overlays the first filesystem namespace over the second filesystem namespace. The computer system identifies an operation on the merged filesystem namespace that requests to read from a file within the merged filesystem namespace, the file being stored in the second filesystem namespace and not being stored in the first filesystem namespace. The computer system returns a handle referencing a proxy object stored in a system memory. The proxy object includes a mapping to a file object corresponding to the file as stored in the second filesystem namespace.