# volumes Published articles for volumes. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions DevFeed: [Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions]() Original publisher: [Read original article]() Author: Nispriha Jagan; Neeraj Krishna Gopalakrishna Published: 2026-09-16T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Security](), [mount](), [Filesystems](), [chmod](), [Unix]() Tags: [chmod](), [container](), [containers](), [filesystem](), [hardening](), [kubernetes](), [linux](), [mount](), [permissions](), [storage](), [volume](), [volumes]() ### AI overview Kubernetes v1.37 adds bind mount options and emptyDir permission modes to strengthen storage security. The article explains how noexec, nosuid, nodev, Unix permissions, and the sticky bit can help enforce security policies on writable volumes. ### Source excerpt Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect. nodev: Do not interpret character or block special devices on the file system. Directory permissions and the sticky bit Standard Unix permissions regulate access across three scopes: Owner, Group, and Others (e.g., 0755 or 0777). Beyond standard read, write, and execute bits, Linux supports the sticky bit (as in mode 01777). When applied to a directory, the sticky bit ensures that a file inside that directory can only be deleted or renamed by the file's owner or root. This is essential for shared writable directories like /tmp. Motivation for the improvements Why does Kubernetes need bind mount options and emptyDir permissions? The primary goal of these features is to increase the security of Kubernetes workloads by allowing security-related bind mount options on volume mounts. By default, volumes are bind-mounted into containers by the container runtime and kubelet without noexec, nosuid, or nodev flags. This default can undermine security. For example, with noexec missing, a compromised process can use any writable volume (emptyDir, PersistentVolume, etc.) to download, chmod +x, and execute arbitra ## Consuming OpenTelemetry Entity Events with an Event-Sourced Consumer DevFeed: [Consuming OpenTelemetry Entity Events with an Event-Sourced Consumer]() Original publisher: [Read original article]() Author: OpenTelemetry Authors; Docs CC BY Published: 2026-08-14T07:10:08Z Content type: tutorial Language: en Sources: [Blog on OpenTelemetry]() Topics: [OpenTelemetry](), [observability](), [telemetry](), [systems]() Tags: [logs](), [metrics](), [observability](), [open-source](), [opentelemetry](), [services](), [systems](), [traces](), [volumes]() ### AI overview This post explains how to consume OpenTelemetry entity events, which represent the inventory and lifecycle changes of hosts, interfaces, switches, services, and volumes. It presents an open source consumer as a worked example and recommends an event-sourced pipeline that preserves both current state and history. ### Source excerpt Metrics, logs, and traces tell you how your systems behave. They are much quieter about what actually exists: which hosts, interfaces, switches, services, and volumes are out there right now, and, crucially, how that picture changed over the last hour, day, or quarter. That living inventory has stayed a blind spot in the open observability stack. OpenTelemetry's entity events, coming out of the Entities SIG and described in the Entity Data Model, are the piece that starts to close it. Entity events are a stream. The interesting question is "what do I do once they arrive?" This post walks through one answer, using an open source consumer as a worked example. ## Spotlight on SIG Storage DevFeed: [Spotlight on SIG Storage]() Original publisher: [Read original article]() Author: The Kubernetes Authors Published: 2026-06-15T00:00:00Z Content type: article Language: en Sources: [Kubernetes Contributors Blog]() Topics: [Kubernetes](), [systems](), [data]() Tags: [backups](), [containers](), [distributed-system](), [kubernetes](), [storage](), [volumes]() ### AI overview An interview with Xing Yang, co-chair of Kubernetes SIG Storage, covering the group's role in persistent data and volume management, Kubernetes CSI maintenance, recent storage features, and data protection work such as Volume Group Snapshot and Changed Block Tracking. ### Source excerpt In our ongoing SIG Spotlight series, we shine a light on the groups that keep the Kubernetes project moving forward. This time, we catch up with SIG Storage , the group responsible for persistent data, volume management, and the interfaces that connect Kubernetes workloads to the storage systems beneath them. We spoke with Xing Yang , Co-Chair of SIG Storage and Software Engineer at VMware by Broadcom, about the SIG's history, the features shipping in recent Kubernetes releases, and where storage in Kubernetes is headed as AI workloads become the norm. Introductions Could you introduce yourself and share your role(s) within SIG Storage? My name is Xing Yang , a software engineer at VMware by Broadcom. I'm a co-chair in SIG Storage, alongside another co-chair Saad Ali from Google. There are also two Tech Leads in SIG Storage: Michelle Au from Google and Jan Šafránek from Red Hat. What first drew you to storage in Kubernetes, and how did you start contributing? I have always been working in the storage domain, so SIG Storage was a natural place for me to get started when I began to learn Kubernetes. I started attending SIG Storage meetings , trying to figure out what I could do to help. This was before the first Container Storage Interface (CSI) release -- lots of things were still evolving. It was a very exciting time. What subprojects or areas do you actively maintain or review today? I'm a maintainer in Kubernetes CSI. There are multiple CSI sidecars -- such as csi-provisioner, csi-attacher, csi-resizer, and csi-snapshotter -- that we need to release following every Kubernetes release. I'm also a co-chair for a Data Protection Working Group co-sponsored by SIG Storage and SIG Apps . Several features have come out of that WG aimed at filling gaps in data protection support within Kubernetes. One is Volume Group Snapshot , which provides crash-consistent group snapshots for multiple volumes used by an application. Changed Block Tracking (CBT) is another critical feature ## From Docker Compose to Kubernetes: A Practical Migration Guide (2026) DevFeed: [From Docker Compose to Kubernetes: A Practical Migration Guide (2026)]() Original publisher: [Read original article]() Author: Urolime Technologies Published: 2026-06-11T13:06:36Z Content type: tutorial Language: en Sources: [Kubernetes Archives - Urolime Blogs]() Topics: [Docker Compose](), [Kubernetes](), [migration](), [Development]() Tags: [complexity](), [compose](), [container](), [guide](), [kubernetes](), [kubernetes-consulting-services](), [kubernetes-services](), [migration](), [migration-guide](), [services](), [speed](), [systems](), [testing](), [volumes](), [yaml]() ### AI overview A practical guide comparing Docker Compose with Kubernetes for applications that outgrow local or small deployments. It explains Kubernetes capabilities such as scaling, self-healing, declarative infrastructure, service discovery, load balancing, and portability, and introduces the architectural and operational changes involved in migration. ### Source excerpt In the very first stages of application development, approach simplicity and speed are the main aspects that matter. That's why Docker Compose has long been a preferred tool for developers who are building and testing multi-container applications. However, as systems grow - in feature, size and complexity, organizations inevitably reach a point where Compose no [...] ## AI sandboxes & volumes: isolated environments for coding agents DevFeed: [AI sandboxes & volumes: isolated environments for coding agents]() Original publisher: [Read original article]() Author: Ruben Fiszel Published: 2026-04-01T00:00:00Z Content type: article Language: en Sources: [Windmill Blog]() Topics: [AI Sandbox](), [AI-assisted coding](), [Claude Code](), [codex](), [Persistence](), [Authorization]() Tags: [agents](), [ai](), [claude-code](), [codex](), [coding-agents](), [environment-variables](), [launch-week](), [permission](), [persistence](), [sandboxes](), [scope](), [volumes]() ### AI overview Windmill introduces AI sandboxes that run Claude Code, Codex, and custom agents in isolated environments with persistent volumes. The article explains how annotations provide process isolation and storage, including synchronization with object storage, exclusive volume leases, caching, and per-user or per-group permissions. ### Source excerpt Introducing AI sandboxes: run Claude Code, Codex, or custom agents in isolated environments with persistent volumes on Windmill. ## Consistent Sizing for Memory Volumes in Kubernetes DevFeed: [Consistent Sizing for Memory Volumes in Kubernetes]() Original publisher: [Read original article]() Author: Abhimanyu Saharan Published: 2025-05-29T00:00:00Z Content type: article Language: en Sources: [Abhimanyu Saharan]() Topics: [Kubernetes]() Tags: [consistency](), [kubernetes](), [memory](), [volumes]() ### AI overview Kubernetes now sizes memory-backed emptyDir volumes according to pod memory limits, improving portability and consistency across different node types. ### Source excerpt Kubernetes now aligns memory-backed emptyDir volumes with pod memory limits for improved portability and consistency across node types. ## Best practices for writing Dockerfiles - Follow "Filesystem Hierarchy Standard" DevFeed: [Best practices for writing Dockerfiles - Follow "Filesystem Hierarchy Standard"]() Original publisher: [Read original article]() Author: Tom Published: 2024-03-11T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Dockerfile](), [Filesystems](), [Docker Image](), [Containers](), [maintenance]() Tags: [best-practices](), [containers](), [docker](), [docker-container-maintainability](), [docker-image](), [docker-image-organization](), [dockerfile-best-practices](), [dockerfiles](), [fhs-guidelines](), [filesystem-hierarchy-standard](), [linux](), [maintainability](), [volumes]() ### AI overview This tutorial explains how to organize Docker images according to the Filesystem Hierarchy Standard. It covers locations for scripts, binaries, Java artifacts, web content, and temporary or writable files, recommending volumes for files that containers must write. ### Source excerpt Learn best practices for writing Dockerfiles by following the Filesystem Hierarchy Standard (FHS) to enhance organization and maintainability of your Docker images. ## Docker Best Practices - Use VOLUME for temporary and mutable files DevFeed: [Docker Best Practices - Use VOLUME for temporary and mutable files]() Original publisher: [Read original article]() Author: Tom Published: 2022-09-12T00:00:00Z Content type: article Language: en Sources: [Tomasz Gągor]() Topics: [Docker](), [Dockerfile]() Tags: [best-practices](), [docker](), [docker-container-performance](), [docker-image-maintenance](), [docker-image-optimization](), [docker-volume-usage](), [dockerfile-best-practices](), [dockerfiles](), [performance](), [temporary-file-locations-docker](), [volume](), [volumes]() ### AI overview The article recommends using Dockerfile VOLUME declarations for temporary and mutable file locations. It explains that volumes are separate from layered image filesystems, can improve performance, and help keep images clean, while noting that unused anonymous volumes require periodic cleanup. ### Source excerpt Learn best practices for writing Dockerfiles by using VOLUME for all mutable, temporary file locations to enhance performance and maintain cleaner images. ## Cloud Native Distributed Storage in Kubernetes with Longhorn DevFeed: [Cloud Native Distributed Storage in Kubernetes with Longhorn]() Original publisher: [Read original article]() Author: Techno Tim Published: 2021-01-02T14:00:00Z Content type: tutorial Language: en Sources: [Techno Tim]() Topics: [Kubernetes](), [Open Source](), [rancher]() Tags: [backups](), [cloud-native](), [disaster-recovery](), [distributed](), [install](), [kubernetes](), [open-source](), [quick-start](), [rancher](), [snapshots](), [storage](), [ui](), [volumes]() ### AI overview A tutorial about using Longhorn, an open-source distributed block storage system for Kubernetes. It covers storage management on Kubernetes clusters, including volumes, backups, snapshots, and disaster recovery, with or without Rancher. ### Source excerpt Storage in Kubernetes is hard, complicated, and messy.Configuring volumes, mounts, and persistent volumes claims and getting it right can be a challenge.It's also challenging to manage that storage and replicate it across all your Kubernetes clusters.It's also been very challenging to do this on bare metal, outside of a cloud provider.That's where Longhorn comes.Longhorn is an open source, a CN... ## Data Persistency and Advanced SQL Server Disk Topologies in Kubernetes DevFeed: [Data Persistency and Advanced SQL Server Disk Topologies in Kubernetes]() Original publisher: [Read original article]() Author: Anthony Nocentino Published: 2019-05-08T15:09:33Z Content type: tutorial Language: en Sources: [Kubernetes on Anthony Nocentino's Blog]() Topics: [Kubernetes](), [sql-server](), [Containers](), [Databases](), [Filesystems]() Tags: [configuration](), [container](), [containers](), [databases](), [environment-variables](), [how-to](), [kubernetes](), [performance](), [sql-server](), [stateful](), [stateless](), [storage](), [volumes]() ### AI overview This tutorial explains how to deploy SQL Server in Kubernetes with Persistent Volumes for system and user databases. It describes how Kubernetes Pod recreation affects stateful workloads and how environment variables and persistent storage preserve SQL Server configuration and database state. ### Source excerpt When working with SQL Server in containers and Kubernetes storage is a key concept. In this post, we're going to walk through how to deploy SQL Server in Kubernetes with Persistent Volumes for the system and user databases. One of the key principals of Kubernetes is the ephemerality of Pods. No Pod is every redeployed, a completely new Pod is created. If a Pod dies, for whatever reason, a new Pod is created in its place there is no continuity in the state of that Pod. The newly created Pod will go back to the initial state of the container image defined in the Pod's spec. This is very valuable for stateless workloads, not so much for stateful workloads like SQL Server. ## Mount volumes and when not to mount volumes, that is the question DevFeed: [Mount volumes and when not to mount volumes, that is the question]() Original publisher: [Read original article]() Author: Unknown (noreply@blogger.com) Published: 2018-12-31T06:50:00Z Content type: article Language: en Sources: [CSC - IT Center For Science - Cloud Team]() Topics: [mount](), [Filesystems](), [Linux](), [Cloud]() Tags: [cinder](), [cloud](), [cpouta](), [filesystem](), [fstab](), [image](), [linux](), [maintenance](), [mount](), [openstack](), [pouta](), [server](), [storage](), [systemd](), [volume](), [volumes]() ### AI overview This article explains how to mount block-device volumes in Linux instances and why relying on standard /etc/fstab entries can prevent an instance from booting when a volume is missing or differs after an image-based deployment. It recommends mount options such as nofail and discusses noauto. ### Source excerpt Some background: As part of the CSC Pouta Cloud Openstack installation we provide the cinder service. This allows our customers to attach block devices to their instances. A common way to illustrate what this means is to say: ".. it's like attaching a USB drive to the instance. " - Some Openstack trainer After attaching the block devices one has to format it with a filesystem and mount it. The usual way to mount block devices (in most Linux based distributions I've seen, if you know other ways please comment below!) every time the server reboots is to put something like this into /etc/fstab: /dev/vdb1 /mnt ext4 defaults 0 0 All clear so far I hope. It mounts block device /dev/vdb to /mnt as filesystem ext4 with the defaults mount options and the last two fields (numbers) are about dumping and file system checks. (Sometimes it's wise to use UUID or LABEL and not /dev/vdb1 in case you have more than two volumes.) But what happens if disk with is not there anymore? Well, with the above fstab your instance will not boot into the operating system. You'll be stuck having to perhaps enter single user mode or attaching a volume and then rebooting and modifying fstab. Single user mode is probably OK sometimes (it's inconvenient and takes time). But let's say you took a snapshot of an instance in Openstack with the glance service. This creates an image of the root disk. If you then spawn a new instance with that image as a root disk it will still have that /dev/vdb1 in /etc/fstab. Hey ho, the new instance booted from the image will not boot. Here you could of course just create a new volume and attach it. But if you used UUID or LABEL in fstab then it wouldn't find those and also break! So what is the best(tm) way? By using some nice fstab mount options. For example nofail UUID=1c7fc2f-f9d9-4e01-8d0f-190f05416831 /mnt ext4 nofail,defaults 0 0 There's another mount option called "noauto". The difference is put quite nicely in this stackoverflow question which has a piece from ## How to install and use Docker Compose DevFeed: [How to install and use Docker Compose]() Original publisher: [Read original article]() Author: Tom Published: 2016-02-12T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Docker Compose](), [Docker](), [configuration](), [container]() Tags: [applications](), [bash](), [command](), [commands](), [configuration](), [container](), [containerization](), [containers](), [desktop](), [devops](), [docker](), [docker-compose](), [examples](), [guide](), [how-to](), [linux](), [networks](), [orchestration](), [run](), [services](), [syntax](), [updated](), [volumes](), [with]() ### AI overview A practical guide to installing and using Docker Compose to automate multi-container Docker applications. It covers installation options, Bash completion, configuration files, running environments, detached execution, and cleanup commands. ### Source excerpt A quick guide to installing and using Docker Compose for automating multi-container Docker applications, including command examples and a sample configuration file. ## Some useful commands in Docker DevFeed: [Some useful commands in Docker]() Original publisher: [Read original article]() Author: Tom Published: 2016-02-11T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Docker](), [Containers](), [docker images]() Tags: [build](), [commands](), [container](), [containers](), [docker](), [docker-images](), [image](), [logs](), [running](), [volumes]() ### AI overview A practical Docker tutorial listing commands for managing containers, images, and volumes, running and entering containers, viewing build logs, and building an image from the current directory. ### Source excerpt I started playing with Docker and here I will write some commands that where not so obvious at beginning 😃 List running containers: docker ps List also not running containers: docker ps -a Remove all containers (be careful with that): docker rm $(docker ps -a -q) Remove all images: docker rmi $(docker images -q) Docker won't remove any old volumes used by containers, so after some time you may be interested in deleting them all: