The named volume mongodb_data ensures data persistence across restarts. As long as authentication is not enabled, publish the port on the loopback interface only (127.0.0.1) so MongoDB is not exposed on all interfaces.
Choose a strong password. Passing MONGO_INITDB_ROOT_PASSWORD in plaintext exposes it via docker inspect, docker ps and the shell history: prefer --env-file, Docker secrets, or the MONGO_INITDB_ROOT_PASSWORD_FILE variant that reads the password from a mounted file.
Data directory inside the container (to be mounted on a volume).
config
/etc/mongod.conf.orig
Default configuration copied into the image, but NOT read at startup: mongod is launched via CMD ['mongod'] without --config. To apply a config, mount your own file AND override the command (command: ['mongod','--config','/etc/mongod.conf']).
Default ports
27017
Command-line tools
docker exec -it mongodb mongoshOpens the mongosh shell inside the container.
Without a volume, data is lost when the container is removed.
The official image is mongo (Docker Hub); pin a major version (mongo:8) in production.
MongoDB with Docker
The official mongo image starts a ready-to-use server. Mount a named volume
on /data/db to keep your data. Expose port 27017 to access it from the
host.
For a deployment, define a root user via
MONGO_INITDB_ROOT_USERNAME / MONGO_INITDB_ROOT_PASSWORD and pin a specific
image version.