Checkpoint Lab — Volumes, Named Volumes, Volume Drivers, Backup/Restore, Sharing, and Persistent Data Patterns

1. Workspace and preflight evidence

mkdir -p da20-checkpoint/backup da20-checkpoint/evidence
cd da20-checkpoint

{
  date -Iseconds
  docker version
  docker info
  docker context show
  docker compose version || true
  docker buildx version || true
  docker buildx inspect --bootstrap 2>/dev/null || true
} > evidence/platform.txt 2>&1

docker pull busybox:1.36.1
docker image inspect busybox:1.36.1   --format 'ID={{.Id}} RepoDigests={{json .RepoDigests}}'   > evidence/image-identity.txt

docker volume ls --filter label=devops-academy.lab=ch20-checkpoint   > evidence/preexisting-volumes.txt
docker ps -a --filter label=devops-academy.lab=ch20-checkpoint   > evidence/preexisting-containers.txt

Record any platform limitation: Docker Desktop managed VM, rootless mode, non-default context, or remote daemon. The lab does not require host access to the volume mountpoint.

2. Predict state changes before execution

cat > evidence/predictions.txt <<'EOF'
A. Creating da20-cp-data creates a Docker volume object but no container.
B. Removing the writer container will not delete da20-cp-data or its files.
C. Backup creation will not modify the source volume because it is mounted read-only.
D. Restoring into da20-cp-restore will create a different volume object whose file checksums should match the source snapshot.
E. Exact final volume removal will succeed only after no containers reference the volumes.
EOF

3. Create primary volume and versioned state

docker volume create   --driver local   --label devops-academy.lab=ch20-checkpoint   --label devops-academy.role=primary   da20-cp-data

docker volume inspect da20-cp-data > evidence/primary-volume-created.json

docker run -d --name da20-cp-writer   --label devops-academy.lab=ch20-checkpoint   --mount type=volume,src=da20-cp-data,dst=/data   busybox:1.36.1 sh -c '
    set -eu
    printf "dataset-version=2026.09.21-1\n" > /data/VERSION
    printf "id,value\n1,alpha\n2,beta\n3,gamma\n" > /data/data.csv
    printf "created-by=chapter20-checkpoint\n" > /data/METADATA
    exec sleep 3600
  '

docker inspect da20-cp-writer > evidence/writer-container.json
docker exec da20-cp-writer sh -c 'cd /data; sha256sum VERSION data.csv METADATA; ls -ln .'   | tee evidence/primary-before-replacement.txt

4. Replace the container while retaining data

Remove the writer container, then create a different read-only verifier against the same volume. This proves compute replacement and data retention independently.

docker rm -f da20-cp-writer

docker run --rm --name da20-cp-verifier   --label devops-academy.lab=ch20-checkpoint   --mount type=volume,src=da20-cp-data,dst=/data,readonly   busybox:1.36.1 sh -c '
    cd /data
    cat VERSION
    cat data.csv
    sha256sum VERSION data.csv METADATA
    ls -ln .
  ' | tee evidence/after-container-replacement.txt

docker volume inspect da20-cp-data > evidence/primary-after-replacement.json

5. Create the backup under an explicit consistency condition

No writer is attached, so the source is quiescent for this synthetic filesystem-level backup. Capture a manifest inside the backup directory before archiving.

docker run --rm --name da20-cp-backup   --label devops-academy.lab=ch20-checkpoint   --mount type=volume,src=da20-cp-data,dst=/source,readonly   --mount type=bind,src="$(pwd)/backup",dst=/backup   busybox:1.36.1 sh -c '
    set -eu
    date -Iseconds > /backup/backup-created.txt
    cd /source
    sha256sum VERSION data.csv METADATA > /backup/source-files.sha256
    tar -czf /backup/da20-cp-data.tgz .
    cd /backup
    sha256sum da20-cp-data.tgz > da20-cp-data.tgz.sha256
  '

sha256sum -c backup/da20-cp-data.tgz.sha256
cp backup/da20-cp-data.tgz.sha256 evidence/
cp backup/source-files.sha256 evidence/
cp backup/backup-created.txt evidence/

6. Restore into a new volume

docker volume create   --driver local   --label devops-academy.lab=ch20-checkpoint   --label devops-academy.role=restore   da20-cp-restore

docker volume inspect da20-cp-restore > evidence/restore-volume-created.json

docker run --rm --name da20-cp-restore-helper   --label devops-academy.lab=ch20-checkpoint   --mount type=volume,src=da20-cp-restore,dst=/restore   --mount type=bind,src="$(pwd)/backup",dst=/backup,readonly   busybox:1.36.1 sh -c '
    set -eu
    cd /restore
    tar -xzf /backup/da20-cp-data.tgz
    cat VERSION
    sha256sum VERSION data.csv METADATA
    ls -ln .
  ' | tee evidence/restore-operation.txt

7. Independently verify source and restored state

docker run \
  --rm \
  --mount type=volume,src=da20-cp-data,dst=/data,readonly   busybox:1.36.1 sh -c 'cd /data; sha256sum VERSION data.csv METADATA'   | sort > evidence/source-current.sha256

docker run \
  --rm \
  --mount type=volume,src=da20-cp-restore,dst=/data,readonly   busybox:1.36.1 sh -c 'cd /data; sha256sum VERSION data.csv METADATA; ls -ln .'   | tee evidence/restored-state.txt

docker run \
  --rm \
  --mount type=volume,src=da20-cp-restore,dst=/data,readonly   busybox:1.36.1 sh -c 'cd /data; sha256sum VERSION data.csv METADATA'   | sort > evidence/restore-current.sha256

diff -u evidence/source-current.sha256 evidence/restore-current.sha256

docker run \
  --rm \
  --mount type=volume,src=da20-cp-restore,dst=/data,readonly   busybox:1.36.1 sh -c 'test "$(cat /data/VERSION)" = "dataset-version=2026.09.21-1" && echo logical-version-ok'   | tee evidence/logical-version-check.txt

For a real application, add an application-level startup/read/query verification here. Byte equality is necessary for this synthetic dataset, but databases need their own recovery validation.

8. Document RPO, RTO, and consistency limitations

cat > evidence/recovery-notes.txt <<'EOF'
Consistency method: source had no writer attached during archive; filesystem-level synthetic backup.
RPO: state captured at backup-created.txt timestamp; writes after that time would not be included.
RTO: not measured as a production SLA; record observed restore duration separately if desired.
Failure domain: backup directory is on this workstation/host; it is not protection against loss of the same host unless copied elsewhere.
Application limitation: this is file data, not a transactional database. Real databases require supported application-consistent backup/restore procedures.
Driver assumption: built-in local driver only; remote/plugin semantics were not tested.
EOF
cat evidence/recovery-notes.txt

9. Dependency and retention check before deletion

docker ps -a --filter volume=da20-cp-data --no-trunc   > evidence/primary-consumers-before-cleanup.txt
docker ps -a --filter volume=da20-cp-restore --no-trunc   > evidence/restore-consumers-before-cleanup.txt

docker volume inspect da20-cp-data da20-cp-restore   > evidence/volumes-before-cleanup.json

docker volume ls --filter label=devops-academy.lab=ch20-checkpoint   > evidence/volume-inventory-before-cleanup.txt

Review these files before deletion. If any unexpected container references a volume, do not remove it.

10. Package the evidence packet

tar -czf da20-evidence.tgz evidence backup/da20-cp-data.tgz.sha256 backup/source-files.sha256
ls -lh da20-evidence.tgz
sha256sum da20-evidence.tgz | tee evidence/evidence-archive.sha256

11. Exact cleanup after evidence review

# These exact lab containers should already be gone, but remove exact names defensively.
docker rm -f da20-cp-writer da20-cp-verifier da20-cp-backup da20-cp-restore-helper 2>/dev/null || true

docker ps -a --filter volume=da20-cp-data --no-trunc
docker ps -a --filter volume=da20-cp-restore --no-trunc

# Only after the dependency queries are empty:
docker volume rm da20-cp-data da20-cp-restore

docker volume ls --filter label=devops-academy.lab=ch20-checkpoint

# Keep da20-evidence.tgz and backup/ until you intentionally delete them.

12. What Chapter 20 adds to the production operating model

You can now treat persistent data as an independently owned resource: inspect its driver and consumers, retain it across container replacement, define consistency before backup, identify backup artifacts with checksums, restore into a separate target, verify ownership and logical state, and delete only after explicit dependency and retention checks.

Chapter 21 tightens the storage model by examining bind mounts, read-only mounts, tmpfs, propagation, subpaths, SELinux labels, and the additional host coupling that appears when the host filesystem becomes part of the container contract.

Knowledge check

Official references and version notes

• Docker Docs — Volumes — volume lifecycle, mount behavior, backup/restore examples, read-only mounts, volume-nocopy, subpaths, and removal.
• Docker CLI — docker volume — create, inspect, list, remove, prune, and update subcommands.
• Docker CLI — docker volume inspect — driver, labels, options, scope, creation timestamp, and mountpoint where the driver exposes one.
• Docker CLI — docker volume create — driver selection, driver options, labels, and cluster-volume options.
• Docker CLI — docker volume rm — exact volume removal and in-use protection.
• Compose Specification — top-level volumes — project-managed versus external volumes and driver/option declarations.
• Docker CLI — docker compose down — default retention, --volumes deletion semantics, and external-volume protection.
• Docker Docs — Volume plugins — driver boundaries and why remote/plugin semantics must be learned from the selected driver.
• Docker Engine 29 release notes — current Engine baseline.