github.com/pwn-term/docker@v0.0.0-20210616085119-6e977cce2565/cli/man/src/container/create.md (about)

     1  Creates a writeable container layer over the specified image and prepares it for
     2  running the specified command. The container ID is then printed to STDOUT. This
     3  is similar to **docker run -d** except the container is never started. You can 
     4  then use the **docker start <container_id>** command to start the container at
     5  any point.
     6  
     7  The initial status of the container created with **docker create** is 'created'.
     8  
     9  ### OPTIONS 
    10  
    11  The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
    12  can be an absolute path or a `name` value. A `name` value must start with an
    13  alphanumeric character, followed by `a-z0-9`, `_` (underscore), `.` (period) or
    14  `-` (hyphen). An absolute path starts with a `/` (forward slash).
    15  
    16  If you supply a `HOST-DIR` that is an absolute path,  Docker bind-mounts to the
    17  path you specify. If you supply a `name`, Docker creates a named volume by that
    18  `name`. For example, you can specify either `/foo` or `foo` for a `HOST-DIR`
    19  value. If you supply the `/foo` value, Docker creates a bind mount. If you
    20  supply the `foo` specification, Docker creates a named volume.
    21  
    22  You can specify multiple  **-v** options to mount one or more mounts to a
    23  container. To use these same mounts in other containers, specify the
    24  **--volumes-from** option also.
    25  
    26  You can supply additional options for each bind mount following an additional
    27  colon.  A `:ro` or `:rw` suffix mounts a volume in read-only or read-write
    28  mode, respectively. By default, volumes are mounted in read-write mode.  
    29  You can also specify the consistency requirement for the mount, either
    30  `:consistent` (the default), `:cached`, or `:delegated`.  Multiple options are
    31  separated by commas, e.g. `:ro,cached`.
    32  
    33  Labeling systems like SELinux require that proper labels are placed on volume
    34  content mounted into a container. Without a label, the security system might
    35  prevent the processes running inside the container from using the content. By
    36  default, Docker does not change the labels set by the OS.
    37  
    38  To change a label in the container context, you can add either of two suffixes
    39  `:z` or `:Z` to the volume mount. These suffixes tell Docker to relabel file
    40  objects on the shared volumes. The `z` option tells Docker that two containers
    41  share the volume content. As a result, Docker labels the content with a shared
    42  content label. Shared volume labels allow all containers to read/write content.
    43  The `Z` option tells Docker to label the content with a private unshared label.
    44  Only the current container can use a private volume.
    45  
    46  By default bind mounted volumes are `private`. That means any mounts done
    47  inside container will not be visible on host and vice-a-versa. One can change
    48  this behavior by specifying a volume mount propagation property. Making a
    49  volume `shared` mounts done under that volume inside container will be
    50  visible on host and vice-a-versa. Making a volume `slave` enables only one
    51  way mount propagation and that is mounts done on host under that volume
    52  will be visible inside container but not the other way around.
    53  
    54  To control mount propagation property of volume one can use `:[r]shared`,
    55  `:[r]slave` or `:[r]private` propagation flag. Propagation property can
    56  be specified only for bind mounted volumes and not for internal volumes or
    57  named volumes. For mount propagation to work source mount point (mount point
    58  where source dir is mounted on) has to have right propagation properties. For
    59  shared volumes, source mount point has to be shared. And for slave volumes,
    60  source mount has to be either shared or slave.
    61  
    62  Use `df <source-dir>` to figure out the source mount and then use
    63  `findmnt -o TARGET,PROPAGATION <source-mount-dir>` to figure out propagation
    64  properties of source mount. If `findmnt` utility is not available, then one
    65  can look at mount entry for source mount point in `/proc/self/mountinfo`. Look
    66  at `optional fields` and see if any propagation properties are specified.
    67  `shared:X` means mount is `shared`, `master:X` means mount is `slave` and if
    68  nothing is there that means mount is `private`.
    69  
    70  To change propagation properties of a mount point use `mount` command. For
    71  example, if one wants to bind mount source directory `/foo` one can do
    72  `mount --bind /foo /foo` and `mount --make-private --make-shared /foo`. This
    73  will convert /foo into a `shared` mount point. Alternatively one can directly
    74  change propagation properties of source mount. Say `/` is source mount for
    75  `/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount.
    76  
    77  > **Note**:
    78  > When using systemd to manage the Docker daemon's start and stop, in the systemd
    79  > unit file there is an option to control mount propagation for the Docker daemon
    80  > itself, called `MountFlags`. The value of this setting may cause Docker to not
    81  > see mount propagation changes made on the mount point. For example, if this value
    82  > is `slave`, you may not be able to use the `shared` or `rshared` propagation on
    83  > a volume.
    84  
    85  
    86  To disable automatic copying of data from the container path to the volume, use
    87  the `nocopy` flag. The `nocopy` flag can be set on named volumes, and does not
    88  apply to bind mounts..