Container Storage
Containers are ephemeral by default — when a container restarts, its filesystem is reset. For applications that need to persist data, Kubernetes provides a storage system.
The Problem
Container starts → writes data to /data/
Container crashes → kubelet restarts it
New container → /data/ is EMPTY (data lost!)
To solve this, Kubernetes uses Volumes to persist data beyond the container lifecycle.
Volume Types
emptyDir
| Aspect |
Details |
| Lifecycle |
Created when pod starts, deleted when pod is deleted |
| Shared between |
All containers in the same pod |
| Survives container restarts? |
Yes |
| Survives pod deletion? |
No |
| Use case |
Temporary shared storage between containers in a pod |
hostPath
| Aspect |
Details |
| Lifecycle |
Exists on the node filesystem |
| Shared between |
Pods on the same node |
| Survives pod deletion? |
Yes (data stays on the node) |
| Risk |
Ties pods to specific nodes; security risk |
| Use case |
Accessing host files (logs, Docker socket) — mostly for system services |
Persistent Volumes (PV) and PersistentVolumeClaims (PVC)
For true persistent storage, Kubernetes uses a two-part system:
┌────────────────┐ ┌─────────────────┐ ┌──────────────────┐
│ Pod │ │ PVC │ │ PV │
│ (uses volume) │────►│ (requests │────►│ (actual storage) │
│ │ │ storage) │ │ (EBS, NFS, etc.) │
└────────────────┘ └─────────────────┘ └──────────────────┘
PersistentVolume (PV)
| Aspect |
Details |
| What it is |
A piece of storage provisioned in the cluster |
| Who creates it |
Admin (manually) or StorageClass (dynamically) |
| Scope |
Cluster-wide (not namespaced) |
| Lifecycle |
Independent of any pod |
PersistentVolumeClaim (PVC)
| Aspect |
Details |
| What it is |
A request for storage by a pod |
| Who creates it |
Application developer |
| Scope |
Namespaced |
| Binding |
Kubernetes matches PVC to an available PV |
How They Work Together
- Admin creates a PV (or StorageClass handles it automatically)
- Developer creates a PVC requesting storage (size, access mode)
- Kubernetes binds the PVC to a matching PV
- Pod references the PVC in its volume spec
- Data persists even if the pod is deleted and recreated
StorageClasses
A StorageClass enables dynamic provisioning — PVs are created automatically when a PVC is submitted:
| Aspect |
Details |
| Without StorageClass |
Admin must manually create PVs ahead of time |
| With StorageClass |
PVs are created on demand when PVCs are submitted |
| Provisioner |
Tells K8s which storage backend to use (AWS EBS, GCE PD, NFS, etc.) |
Common Provisioners
| Cloud |
Provisioner |
Storage Backend |
| AWS |
ebs.csi.aws.com |
EBS volumes |
| GCP |
pd.csi.storage.gke.io |
Persistent Disks |
| Azure |
disk.csi.azure.com |
Azure Disks |
| On-Prem |
Various |
NFS, Ceph, iSCSI |
Access Modes
| Mode |
Abbreviation |
Description |
| ReadWriteOnce |
RWO |
Volume can be mounted read-write by a single node |
| ReadOnlyMany |
ROX |
Volume can be mounted read-only by many nodes |
| ReadWriteMany |
RWX |
Volume can be mounted read-write by many nodes |
| ReadWriteOncePod |
RWOP |
Volume can be mounted read-write by a single pod |
Exam tip: The most common mode is RWO (ReadWriteOnce). RWX requires specific storage backends (NFS, EFS, etc.).
CSI — Container Storage Interface
CSI (Container Storage Interface) standardizes how Kubernetes connects to storage systems:
| Aspect |
Details |
| What it is |
A standard interface between K8s and storage providers |
| Why it exists |
Decouples storage plugins from Kubernetes core code |
| How it works |
Storage vendors implement CSI drivers |
| Examples |
AWS EBS CSI, GCE PD CSI, Ceph CSI |
Pod → PVC → PV → CSI Driver → Storage Backend (EBS, NFS, Ceph, etc.)
Key Takeaways for the Exam
- Containers are ephemeral — data is lost when containers restart. Volumes solve this.
- emptyDir: temporary, shared within a pod, deleted when the pod dies
- PersistentVolume (PV): cluster-wide storage resource, independent of pods
- PersistentVolumeClaim (PVC): a request for storage from a pod
- StorageClasses enable dynamic provisioning — PVs created automatically on demand
- Access modes: RWO (single node), ROX (read-only many), RWX (read-write many)
- CSI standardizes the interface between K8s and storage backends
- PVs are cluster-scoped; PVCs are namespace-scoped
What’s Next?
Let’s cover the security fundamentals for containers.
Container Security Basics →
