Keep data with volumes and bind mounts

$ run as a normal user# run as root (or with sudo)

Choose the storage type

Pick by who manages the data and where it lives.

Type	Where	Good for
Named volume	Managed by Docker/Podman (`/var/lib/docker/volumes`)	Databases, app data
Bind mount	Any host folder	Config files, source code in development
tmpfs	RAM, gone at stop	Secrets at run time, caches

6.2

Use named volumes

Create a volume and mount it; the data survives docker rm and image updates.

$docker volume create pgdata
$docker run -d --name db -e POSTGRES_PASSWORD_FILE=/run/secrets/pg -v pgdata:/var/lib/postgresql/data postgres:16
$docker volume ls
$docker volume inspect pgdata --format '{{.Mountpoint}}'
$docker rm -f db
$docker run -d --name db -v pgdata:/var/lib/postgresql/data postgres:16

6.3

Use bind mounts

Mount a host folder or file into the container — read-only when the container should not change it.

$docker run -d --name web -p 8080:80 -v /srv/site:/usr/share/nginx/html:ro nginx:1.27
$docker run -d --name web2 --mount type=bind,src=/srv/site,dst=/usr/share/nginx/html,readonly nginx:1.27
$podman run -d --name web3 -p 8081:8080 -v /srv/site:/var/www/html:Z registry.access.redhat.com/ubi10/httpd-24

Remember

On RHEL with SELinux, add :Z (private) or :z (shared) to bind mounts, or the container gets "Permission denied".

6.4

Back up and restore a volume

Use a small helper container that mounts the volume and writes a tar file.

$docker run --rm -v pgdata:/data -v "$PWD":/backup alpine tar czf /backup/pgdata-$(date +%F).tgz -C /data .
$docker run --rm -v pgdata:/data -v "$PWD":/backup alpine sh -c "cd /data && tar xzf /backup/pgdata-2026-10-27.tgz"

At work

For databases, prefer the database's own dump tool (pg_dump, mysqldump) — a file copy of a running database can be inconsistent.

6.5

Use tmpfs and read-only containers

A read-only root file system stops attackers from changing files; tmpfs gives the app the few writable places it needs.

$docker run -d --name api --read-only --tmpfs /tmp:rw,size=64m -v api-data:/data myorg/api:2.0

All commands in this chapter