Volumes - persistent data storage - what are they and how to use them

A Docker volume is a persistent storage mechanism managed by Docker that allows data to persist outside the container’s writable layer. Volumes are stored on the host file system, and can be shared across containers.

Why Use Volumes?

• Persistent data: Survives container restarts and removal.
• Isolation: Data is decoupled from the container image.
• Sharing: Volumes can be mounted into multiple containers.
• Performance: Better performance than bind mounts in most cases.
• Portability: Easily managed via Docker CLI and Docker Compose.

Volume types

• Named volume - Created and managed by Docker, stored under /var/lib/docker/volumes/. Ideal for production use.
• Anonymous volume - Not given a specific name. Automatically created and harder to manage (used when just mounting a directory).
• Bind mount - Mounts a specific path from the host into the container. More manual and less portable than volumes.

Creating and Mounting Volumes

CLI Example:

Compose example:

Are Volumes Encrypted?

By default, Docker volumes are not encrypted.

If You Need Encryption:

• Use file system-level encryption on the Docker host (e.g., LUKS or eCryptfs on Linux).
• Or, mount an encrypted file system inside the container.
• Or, use external storage drivers that support encryption (e.g., cloud volume plugins).

Volume Security Considerations

• Volumes are shared on the host, so ensure only trusted containers/users have access.
• No built-in volume encryption or access control.
• Avoid mounting sensitive directories via bind mounts (e.g., /etc, /root).
• Use read-only mounts if a container only needs to read data:

Create a volume

List volumes

Inspecting a volume

You’ll get metadata like:

Removing volumes

Remove unused volume:

Remove all unused volumes:

Volumes vs bind mounts