Overlays are always tough because docker doesn’t like you writing to the filesystem in the first place. The weapon if first result is deflection; tell them not to do it.
I had to put up with an old docker version that leaked overlay data for quite a while before we moved off prem.