The current mechanism of systemd restart/stop is to send SIGTERM (systemd default) to the process (vyos-http-api sytemd setting), which does not guarantee a clean exit since python has no default handler for SIGTERM. Consequently, configsession does not call teardown session from del, polluting the unionfs hierarchy. Changing the systemd KillSignal to SIGINT will address the issue with configsession, however, this will leave a (non-fatal) warning
ResourceWarning: unclosed <socket ...
from python3-bottle before version 0.13-dev (still unreleased fix).
Evaluate the best solution, to enure graceful shutdown/restart.