Answers: <p>I don't know how I missed that, but the mongo image <a href="https://hub.docker.com/_/mongo#where-to-store-data" rel="nofollow noreferrer">by default stores data in a Docker managed volume</a>, and not in the container writable layer as I assumed it initially.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-03-02T23:51:40.907Z
Answers: Writing to the container writable image is an anti-pattern.
Answers: simbo1905
Answers: CC BY-SA 4.0
Answers: 2019-02-26T13:03:53.623Z
Answers: 2019-02-26T13:03:53.623Z
Answers: Sylvain Leroux
Body: <p>I know when you create a container the Docker engine adds a thin writable layer on top of the image layers. And all filesystem changes are recorded in that writable layer.</p>
  
  <p>I know I can use the <code>docker diff</code> command to show the changes made in a container's filesystem compared to the base image.</p>
  
  <p>But surprisingly, I cannot <em>see</em> where data are saved in the following use case involving the official MongoDB image:</p>
  
  <pre><code>sh$ sudo docker run -d --name mongo mongo:3.6.10
  sh$ sudo docker exec -i mongo mongo &lt;&lt; EOF
  &gt; db.test.insert({foo:"bar"})
  &gt; EOF
  MongoDB shell version v3.6.10
  MongoDB server version: 3.6.10
  WriteResult({ "nInserted" : 1 })
  bye
  
  sh$ sudo docker stop mongo
  sh$ sudo docker diff mongo
  C /root
  A /root/.dbshell
  C /tmp
  </code></pre>
  
  <p><code>/tmp</code> is empty. And <code>/root/.dbshell</code> is just the history file for the mongo client. But I can't see any trace of the data files modified by the Mongo DB server. However, data were definitely stored:</p>
  
  <pre><code>sh$ sudo docker start mongo
  sh$ sudo docker exec -i mongo mongo &lt;&lt; EOF
  &gt; db.test.find()
  &gt; EOF
  MongoDB shell version v3.6.10
  MongoDB server version: 3.6.10
  { "_id" : ObjectId("5c750d4cef8f9635fe459f06"), "foo" : "bar" }
  bye
  </code></pre>
  
  <p>And I can find the data when I manually dump the files:</p>
  
  <pre><code>sh$ sudo docker exec mongo bash -c 'tar c /data/db/collection*' | hexdump -C | grep foo
  tar: Removing leading `/' from member names
  0000e840  02 66 6f 6f 00 04 00 00  00 62 61 72 00 00 00 00  |.foo.....bar....|
  </code></pre>
  
  <p><strong>Why can't I find the data files modified by the MongoDB server using <code>docker diff</code>? Did I make some wrong assumption somewhere? Or did I misunderstood something regarding the way <code>docker diff</code> works?</strong></p>
  
Tags: <docker><audit>
Title: Why `docker diff` does not see some file changes?
UserDisplayName: Sylvain Leroux
ThreadText: # Why `docker diff` does not see some file changes?
  
  (Asked by: username_0 on 2019-02-26)
  
  I know when you create a container the Docker engine adds a thin writable layer on top of the image layers. And all filesystem changes are recorded in that writable layer.
  
  I know I can use the `docker diff` command to show the changes made in a container's filesystem compared to the base image.
  
  But surprisingly, I cannot *see* where data are saved in the following use case involving the official MongoDB image:
  
  ```
  sh$ sudo docker run -d --name mongo mongo:3.6.10
  sh$ sudo docker exec -i mongo mongo << EOF
  > db.test.insert({foo:"bar"})
  > EOF
  MongoDB shell version v3.6.10
  MongoDB server version: 3.6.10
  WriteResult({ "nInserted" : 1 })
  bye
  
  sh$ sudo docker stop mongo
  sh$ sudo docker diff mongo
  C /root
  A /root/.dbshell
  C /tmp
  
  ```
  
  `/tmp` is empty. And `/root/.dbshell` is just the history file for the mongo client. But I can't see any trace of the data files modified by the Mongo DB server. However, data were definitely stored:
  
  ```
  sh$ sudo docker start mongo
  sh$ sudo docker exec -i mongo mongo << EOF
  > db.test.find()
  > EOF
  MongoDB shell version v3.6.10
  MongoDB server version: 3.6.10
  { "_id" : ObjectId("5c750d4cef8f9635fe459f06"), "foo" : "bar" }
  bye
  
  ```
  
  And I can find the data when I manually dump the files:
  
  ```
  sh$ sudo docker exec mongo bash -c 'tar c /data/db/collection*' | hexdump -C | grep foo
  tar: Removing leading `/' from member names
  0000e840  02 66 6f 6f 00 04 00 00  00 62 61 72 00 00 00 00  |.foo.....bar....|
  
  ```
  
  **Why can't I find the data files modified by the MongoDB server using `docker diff`? Did I make some wrong assumption somewhere? Or did I misunderstood something regarding the way `docker diff` works?**
  
  **Tags:** docker, audit
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-02-26. Score: 1
  
  I don't know how I missed that, but the mongo image [by default stores data in a Docker managed volume](https://hub.docker.com/_/mongo#where-to-store-data), and not in the container writable layer as I assumed it initially.
  
  > **Comments:**
  > **username_1**: Writing to the container writable image is an anti-pattern.  
  
  ---
  
  