Instead of just mounting tmpfs on `/var/log` I want to use overlayfs. 

1. /var/log are writable tmpfs, but containing files were there before
tmpfs mount. This old files are not in memory of tmpfs but in lower layer.
2. only changes are stored in tmpfs, while old and unmodified files
stored on SSD
3. sometimes it should be possible to write changes to SSD, for example
via cron. This should free up tmpfs memory

So, result should be: logs written to RAM, old and new boot logs accesable via same path. Changes are written sometimes to disk, by script.

Point is to speed up a little, and safe SSD from many writes.

(*I saw similar thing in puppy linux, not for logs, but for all changes to root*, but without installing it can't do the same, documentation not helps)

I will do same for browser cookies/cache based on answer. But persistent write will be done on browser close. Can't turn off browser cache, need at least small cache to have same bugs in my web development as users can have because of cache.