A mount does not merge with the image. It covers the target path, and everything the image had there is out of sight for as long as the mount exists.
text
image: /usr/share/nginx/html/ container sees with
├── 50x.html -v ~/public:/usr/share/nginx/html
└── index.html
/usr/share/nginx/html/
hidden, not deleted ───────► └── .gitkeep (from ~/public)What appears at the mount point
| You mount | The container sees |
|---|---|
| A bind mount of a directory | Exactly the host directory. Image files at that path are hidden |
| A new, empty named or anonymous volume | A copy of the image's files at that path, made on first use |
| A volume that already has data | The volume's data. Nothing is copied |
| A bind mount of a single file | That one file replaces the image's file. Its siblings stay visible |
An empty bind mount over nginx's web root:
text
$ curl -sI localhost:8081
HTTP/1.1 403 Forbidden
Server: nginx/1.27.2text
$ docker logs preview 2>&1 | grep forbidden
2026/10/11 20:50:09 [error] 29#29: *1 directory index of "/usr/share/nginx/html/" is forbidden, client: 172.17.0.1, server: localhost, request: "GET / HTTP/1.1", host: "localhost"The same path with a new named volume gets the image's pages:
sh
docker run -d --name welcome -p 8082:80 -v welcome-html:/usr/share/nginx/html nginx:1.27
sudo ls /var/lib/docker/volumes/welcome-html/_datatext
50x.html index.htmlMount a single file
Mount a file onto a file to replace one config without hiding the rest of the directory:
sh
docker run -d --name maint -p 8083:80 -v ~/conf/maintenance.conf:/etc/nginx/conf.d/default.conf:ro nginx:1.27text
/etc/nginx/
├── conf.d/
│ └── default.conf ◄── ~/conf/maintenance.conf (read-only)
└── nginx.conf ◄── still the image's fileRead-only mounts
Add :ro to -v, or readonly to --mount. Every write through that mount fails, including writes from root:
sh
docker run -d --name preview -p 8081:80 -v ~/release:/usr/share/nginx/html:ro nginx:1.27
docker exec preview touch /usr/share/nginx/html/xtext
touch: cannot touch '/usr/share/nginx/html/x': Read-only file systemThe host can still change the files; the restriction applies only inside the container. docker inspect shows "RW": false for the mount.
| Mount content | Mode |
|---|---|
| Config files, certificates | Read-only |
| Static sites, built assets | Read-only |
| Source code for a dev server that only reads it | Read-only |
| Database data, uploads, caches | Read-write |
Mounting read-only by default limits the damage a compromised or buggy process can do to host files.