Docker Volume, Network ও Security

💾 3 Storage Types

Named volume (DB, persistent):
  mysql-data:/var/lib/mysql

Bind mount (dev code):
  ./code:/var/www

tmpfs (ephemeral, RAM):
  tmpfs: [/tmp]

🛠️ Volume Commands

docker volume create mydata
docker volume ls / inspect / rm / prune

💾 Backup/Restore

# Backup
docker run --rm -v mysql-data:/s:ro -v $(pwd):/b \
  alpine tar czf /b/mysql.tar.gz -C /s .

# Restore
docker run --rm -v mysql-data:/t -v $(pwd):/b \
  alpine tar xzf /b/mysql.tar.gz -C /t

🌐 Network Types

• bridge — default, isolated per host
• host — share host network
• overlay — multi-host (Swarm/K8s)
• none — no network

🔒 Multi-tier Isolation

services:
  nginx:
    networks: [frontend]
    ports: ["80:80"]
  api:
    networks: [frontend, backend]
  db:
    networks: [backend]

networks:
  frontend:
  backend:
    internal: true    # no internet

🛡️ Security Best Practice

• Non-root user — USER app in Dockerfile
• Read-only FS — read_only: true
• Drop capabilities — cap_drop: [ALL]
• Resource limits — prevent fork bomb
• No privileged mode
• Secrets — Docker secret / env from vault
• Bind 127.0.0.1 for internal port

🔐 Non-root Example

FROM node:20-alpine
RUN addgroup -S app && adduser -S app -G app
USER app
WORKDIR /app

🔍 Scan

docker scout cves myapp:1.0
trivy image myapp:1.0
# Add to CI!

🎓 মূল কথা ⭐

DB = named volume। Dev code = bind mount। Production = non-root + read-only + cap drop + scan। Database 0.0.0.0 publish = hack invite।