Mounting local volumes for stateful applications

To understand native Docker storage options for stateful applications, we have to take a look at how the layer filesystem is organized. The main role of this filesystem service is to provide a single virtual logical filesystem for each container based on Docker images.

Docker images consist of a series of read-only layers, where each layer corresponds to one instruction in a Dockerfile. Let's take a look at the following Dockerfile from the previous chapter:

FROM mcr.microsoft.com/windows/servercore/iis:windowsservercore-1903

RUN powershell -NoProfile -Command Remove-Item -Recurse C:\inetpub\wwwroot\*
WORKDIR /inetpub/wwwroot
COPY index.html .

When building a Docker image, (almost) each instruction creates a new layer that contains only a set of differences in the filesystem that a given command has introduced. In this case, we have the following:

• FROM mcr.microsoft.com/windows/servercore/iis:windowsservercore-1903: This instruction defines the base layer (or a set of layers) from the base image.
• RUN powershell -NoProfile -Command Remove-Item -Recurse C:\inetpub\wwwroot\*: The layer that's created by this instruction will reflect the deletion of contents in the C:\inetpub\wwwroot\ directory from the original base image.
• WORKDIR /inetpub/wwwroot: Even though this instruction is not causing any filesystem changes, it will still create no operation (nop) layer to persist this information.
• COPY index.html .: This final instruction creates a layer that consists of index.html in the C:\inetpub\wwwroot\ directory.

If you have an existing Docker image, you can inspect the layers yourself using the docker history command:

docker history <imageName>

For example, for the image resulting from the preceding Dockerfile, you can expect the following output:

The bottom five layers come from the mcr.microsoft.com/windows/servercore/iis:windowsservercore-1903 base image, whereas the top three layers are a result of the instructions we described previously.

When a new container is created, the filesystem for it is created, which consists of read-only image layers and a writeable top layer, also called a container layer. For the container, the layers are transparent and processes "see" it as a regular filesystem – on the Windows system, this is guaranteed by the Windows Container Isolation File System service. Any changes that are made to the container filesystem by the processes inside it are persisted in the writeable layer. This concept can be seen in the following diagram:

Now that we know the principles of the layer filesystem in Docker, we can focus on volumes and bind mounts.