Build-Time COPY Bakes Files In; Volumes Mount Them Live
Two ways a file enters a container: build-time COPY bakes it into the image (rebuild to change), runtime volumes mount a live host path. Bake the plumbing, mount the state.
Two ways a file gets into a container, different phases, different behavior:
| Phase | Persistence | Edit takes effect | |
|---|---|---|---|
COPY (Dockerfile) | build | baked into the image | only after a rebuild |
volumes: (compose) | run | live host path | immediately |
Rule of thumb: bake the plumbing, mount the state. Bake the code/tooling that defines the image (self-contained, reproducible); mount things that must stay on the host or change live: credentials, configs, data.
From this session: the ClickHouse container bakes entrypoint.sh via COPY but mounts ~/.config/gcloud + ~/.kube as volumes, so creds never leak into the image and refresh live, while editing entrypoint.sh requires a rebuild. Same reason it copies the mounted kubeconfig to /tmp before sed: to avoid mutating the live host file.
Bake the plumbing into the image; mount the changing state (creds / config / data) as volumes.
References
- Docker Compose build reference: https://docs.docker.com/reference/compose-file/build/
Related: back to the remote DB overview; the companion is docker-compose image vs build.