Backing up Docker volumes: the canonical pattern
A container writes its data into a named volume; that volume lives outside the container, managed by Docker. To back it up, we never touch the application container: we launch a second, throwaway alpine container that mounts the volume and a host folder at the same time, and uses tar czf to pack the data into a single archive. When it’s done, the container deletes itself (--rm) and the .tar.gz stays behind on the host.
Restoring into a fresh volume
Restoring is the same pattern run in reverse: a throwaway alpine container mounts a brand-new volume and the folder holding the backup, and uses tar xzf to extract the data into it. The restored volume doesn’t have to share the original’s name —this lab proves it, restoring into app_data_restored— because the .tar.gz carries no volume name at all, only the contents.
When to reach for –volumes-from
If you don’t remember a volume’s exact name but you know which container uses it, docker run --volumes-from <container> reuses its mounts on the backup container without you having to look the name up. This lab backs up the same data both ways and diffs the two archives to prove they’re interchangeable.
This lab pairs well with our guides on Docker volumes and bind mounts, Docker resource limits and logging and installing Portainer with Docker Compose, along with the rest of our hands-on labs. For the canonical references, see Docker’s own volumes documentation and the GNU tar manual.
FAQ
Where does a Docker volume actually live on the host?
Docker stores named volumes under /var/lib/docker/volumes/ on the host, in a folder Docker itself manages. You never touch that path directly: you mount the volume by name (-v app_data:/data) and Docker resolves where the data actually lives.
Why use a throwaway alpine container for the backup instead of running tar directly on the host?
Because you don't always have direct access (or permissions) to the volume's internal path on the host, and that path is an implementation detail that can change. A throwaway alpine container with –rm mounts the volume by name, runs the tar, and deletes itself: it works the same regardless of where or how Docker stores the volume internally.
What is the difference between –volumes-from and mounting the volume with -v?
-v app_data:/data mounts the volume by its exact name. –volumes-from app copies every mount from another container (here, 'app') onto the backup container, without you needing to know the volume's name. The backup output is identical; –volumes-from is handy when you only remember which container owns the data.
Can I restore a backup into a volume with a different name?
Yes. The .tar.gz carries no volume name at all, only the files. Just create a new volume with whatever name you want and extract the archive into it with tar xzf: that's exactly what this lab does, restoring into app_data_restored instead of the original app_data.