The current mechanism of systemd restart/stop is to send SIGTERM (systemd default) to the process (vyos-http-api sytemd setting), which does not guarantee a clean exit since python has no default handler for SIGTERM. Consequently, configsession does not call teardown session from __del__, polluting the unionfs hierarchy. Changing the systemd KillSignal to SIGINT will address the issue with configsession, however, this will leave a (non-fatal) warning
ResourceWarning: unclosed <socket ...
in python3-bottle before version 0.13-dev (still unreleased fix).
Evaluate the best solution, to enure graceful shutdown/restart.