Short answer
A container's writable layer is ephemeral — removing the container destroys it — so any data that must survive (databases, uploads) goes on a volume.
Explanation
Named volumes are managed by Docker and are the portable production choice for stateful services; bind mounts map a specific host path and are great for live-reloading source in dev but couple you to host layout and permissions, making them poor for production. The general principle is to keep containers stateless and immutable and push all durable state to volumes or external services.
Common mistakes
- Writing data to the container filesystem.
- Using bind mounts in production without thinking about permissions.