<p>I don't know how I missed that, but the mongo image <a href="https://hub.docker.com/_/mongo#where-to-store-data" rel="nofollow noreferrer">by default stores data in a Docker managed volume</a>, and not in the container writable layer as I assumed it initially.</p>

CC BY-SA 4.0
2019-03-02T23:51:40.907Z
Writing to the container writable image is an anti-pattern.
simbo1905
CC BY-SA 4.0
2019-02-26T13:03:53.623Z
2019-02-26T13:03:53.623Z
Sylvain Leroux
<p>I know when you create a container the Docker engine adds a thin writable layer on top of the image layers. And all filesystem changes are recorded in that writable layer.</p>

<p>I know I can use the <code>docker diff</code> command to show the changes made in a container's filesystem compared to the base image.</p>

<p>But surprisingly, I cannot <em>see</em> where data are saved in the following use case involving the official MongoDB image:</p>

<pre><code>sh$ sudo docker run -d --name mongo mongo:3.6.10
sh$ sudo docker exec -i mongo mongo &lt;&lt; EOF
&gt; db.test.insert({foo:"bar"})
&gt; EOF
MongoDB shell version v3.6.10
MongoDB server version: 3.6.10
WriteResult({ "nInserted" : 1 })
bye

sh$ sudo docker stop mongo
sh$ sudo docker diff mongo
C /root
A /root/.dbshell
C /tmp
</code></pre>

<p><code>/tmp</code> is empty. And <code>/root/.dbshell</code> is just the history file for the mongo client. But I can't see any trace of the data files modified by the Mongo DB server. However, data were definitely stored:</p>

<pre><code>sh$ sudo docker start mongo
sh$ sudo docker exec -i mongo mongo &lt;&lt; EOF
&gt; db.test.find()
&gt; EOF
MongoDB shell version v3.6.10
MongoDB server version: 3.6.10
{ "_id" : ObjectId("5c750d4cef8f9635fe459f06"), "foo" : "bar" }
bye
</code></pre>

<p>And I can find the data when I manually dump the files:</p>

<pre><code>sh$ sudo docker exec mongo bash -c 'tar c /data/db/collection*' | hexdump -C | grep foo
tar: Removing leading `/' from member names
0000e840  02 66 6f 6f 00 04 00 00  00 62 61 72 00 00 00 00  |.foo.....bar....|
</code></pre>

<p><strong>Why can't I find the data files modified by the MongoDB server using <code>docker diff</code>? Did I make some wrong assumption somewhere? Or did I misunderstood something regarding the way <code>docker diff</code> works?</strong></p>

<docker><audit>
Why `docker diff` does not see some file changes?
Sylvain Leroux
# Why `docker diff` does not see some file changes?

(Asked by: username_0 on 2019-02-26)

I know when you create a container the Docker engine adds a thin writable layer on top of the image layers. And all filesystem changes are recorded in that writable layer.
I know I can use the docker diff command to show the changes made in a container's filesystem compared to the base image.
But surprisingly, I cannot see where data are saved in the following use case involving the official MongoDB image:
sh$ sudo docker run -d --name mongo mongo:3.6.10
sh$ sudo docker exec -i mongo mongo << EOF
> db.test.insert({foo:"bar"})
> EOF
MongoDB shell version v3.6.10
MongoDB server version: 3.6.10
WriteResult({ "nInserted" : 1 })
bye

sh$ sudo docker stop mongo
sh$ sudo docker diff mongo
C /root
A /root/.dbshell
C /tmp

/tmp is empty. And /root/.dbshell is just the history file for the mongo client. But I can't see any trace of the data files modified by the Mongo DB server. However, data were definitely stored:
sh$ sudo docker start mongo
sh$ sudo docker exec -i mongo mongo << EOF
> db.test.find()
> EOF
MongoDB shell version v3.6.10
MongoDB server version: 3.6.10
{ "_id" : ObjectId("5c750d4cef8f9635fe459f06"), "foo" : "bar" }
bye

And I can find the data when I manually dump the files:
sh$ sudo docker exec mongo bash -c 'tar c /data/db/collection*' | hexdump -C | grep foo
tar: Removing leading `/' from member names
0000e840  02 66 6f 6f 00 04 00 00  00 62 61 72 00 00 00 00  |.foo.....bar....|

Why can't I find the data files modified by the MongoDB server using docker diff? Did I make some wrong assumption somewhere? Or did I misunderstood something regarding the way docker diff works?

**Tags:** docker, audit


---

## 1 answers

### Answer by username_0 on 2019-02-26. Score: 1

I don't know how I missed that, but the mongo image [by default stores data in a Docker managed volume](https://hub.docker.com/_/mongo#where-to-store-data), and not in the container writable layer as I assumed it initially.

> **Comments:**
> **username_1**: Writing to the container writable image is an anti-pattern.  

---

