Keep mounted docker hard drives. Avoid heavy (re/un)mount on image/stacks updates. (Paranoid)

docker-compose.keepmount.yml

services:
  keepmount:
    image: gcr.io/google-containers/pause:3.2 # Or any looping lightweight image.
    container_name: keepmount
    restart: always

    # Mount volumes read-only
    volumes:
      - keepmount:/mnt/keepmount:ro

    ## Paranoid security

    # Disable networking
    network_mode: none
    hostname: localhost

    # Lock down everything
    read_only: true
    privileged: false
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

    # Even more paranoid
    user: "65534:65534"
    ipc: "none"
    oom_score_adj: 1000

    # Yeah, I've understood... Paranoid
    stop_signal: SIGKILL
    stdin_open: false
    tty: false

    logging:
      driver: "none"

    environment: []

volumes:
  keepmount:
    external: true