Edit on host, run in container
Bind mounts map a host directory directly into the container. Files appear instantly on both sides. With a hot-reload-aware framework (uvicorn --reload, vite, nodemon), this gives you a real IDE on the host and a containerized runtime — without rebuilding the image on every code change.
The :ro modifier
Append :ro to make the mount read-only inside the container. Use this for config files, certificates, anything the container should consume but never modify. It's a lightweight defense-in-depth.