How to stop an AI coding agent deleting Docker volumes and the data in them

The short answer

The command that deletes the most is docker compose down -v: it removes the named volumes declared in your Compose file, which is where a local database keeps its data.¹ docker volume rm deletes volumes you name. docker volume prune only removes unused anonymous volumes unless you add --all.² Put a deny or ask rule on compose down -v and volume rm in your coding agent, keep a dump of anything you’d miss, and don’t keep data you can’t recreate in a volume the agent’s Compose file manages.

Which commands delete what

Docker’s own reference pages, side by side:

Read the first two rows again. down is safe for your data; down -v is not. The difference is two characters, and -v is exactly what an agent adds when “the database has stale state, let me reset it”.

Why agents run them

Coding agents spend a lot of time getting local environments into a working state. When a migration fails because the schema in the container is out of date, the quickest fix is to throw the database away and start over. In a Compose project that’s docker compose down -v && docker compose up -d. For seed data that’s fine. For a local database you’ve spent a week shaping for a bug, or a volume you mounted from a shared drive, it isn’t.

The prompts don’t help much. docker volume prune asks “Are you sure?” unless you pass -f,² and agents pass -f. compose down -v doesn’t ask at all.

What a command guard sees

We ran Deedglass’s shell guard from 0.13.0 against the Docker commands above on 2026-10-27:⁶

Code What the screen or file shows, copied as is.

$ npx deedglass@0.13.0 guard shell --no-files --command 'docker volume rm pgdata'
Deedglass asks first: docker volume rm removes Docker volumes and the data in them.
  docker-volume-rm  docker volume rm removes Docker volumes and the data in them

The catalog row covers docker volume rm, remove and prune.⁶ In 0.13.0 it didn’t cover compose down -v, which, by Docker’s own description, is the one that removes named volumes. That was a real gap, and it’s the most common way an agent deletes local database data in a Compose project. 0.14.1 added a row for it: docker compose down -v, --volumes and docker-compose down -v now get an ask. docker system prune -a --volumes and docker rm -v still pass.⁶

If you’re on 0.13.0 or earlier, or want a rule that doesn’t depend on the guard, add one of your own. In Claude Code, ask and deny rules apply when any part of a compound command matches, and a * can stand anywhere:⁷

Code Data in JSON, the format software uses to pass records and settings.

{
  "permissions": {
    "ask": [
      "Bash(docker compose down*-v*)",
      "Bash(docker compose down*--volumes*)",
      "Bash(docker-compose down*-v*)",
      "Bash(docker volume rm*)",
      "Bash(docker volume prune*)"
    ]
  }
}

npx deedglass protect installs the guard in Claude Code, Cursor, Codex CLI, Gemini CLI and Copilot CLI,⁶ and the rule above adds a second check in Claude Code. Other agents have their own rule formats; our walkthrough of protect lists each agent’s file.

Both layers read text. A make reset target or an npm script that runs compose down -v inside it passes untouched,⁶ and a hook that can’t run lets the command go ahead unchecked.⁶

Protect the data, not just the command

The checks above slow an agent down. These make the deletion not matter:

1. Keep irreplaceable data out of the agent’s Compose project. Use a separate Compose project, or a database outside Docker, for anything you can’t rebuild from seeds.
2. Mark a volume as external. Docker’s Compose reference says a volume with external: true already exists on the platform and its lifecycle is managed outside the application; Compose doesn’t create it.⁸ Create it once with docker volume create pgdata.
3. Dump before you let an agent loose. docker compose exec db pg_dump -U app app > before-agent.sql takes seconds.
4. Make seeds fast. If resetting is cheap and reliable, losing a volume is an inconvenience, not an incident.

On point 2, check the behaviour in your own Docker version before trusting it: create a scratch project, run docker compose down -v, and confirm the external volume survives.

Questions people ask

Does docker compose down delete volumes?

Not by default. With -v or --volumes it removes the named volumes declared in the Compose file and anonymous volumes attached to containers.¹

Does docker volume prune delete named volumes?

Only with --all. By default it removes unused anonymous volumes.²

Can docker volume rm delete a volume a running container uses?

No. Docker won’t remove a volume that’s in use by a container.³

The same approach for clusters is in stopping kubectl delete, for ORM resets in migration commands that delete data, and for sessions with no prompts at all in the bypass mode post. If the data is already gone, start with the first hour after an agent deletes a database.

To check a command yourself, run npx deedglass guard shell --no-files --command 'docker volume rm pgdata'; to grade what an agent can reach, run npx deedglass scan (what the grade means), or watch the checks in the playground.

Written with AI assistance and checked against our claims register.