An image already has files in /app/config. What does the container see at that path if you mount a brand-new named volume there, compared with a bind mount of an empty host directory?

A new named volume shows the image's files. A bind mount of an empty folder shows an empty folder.

New, empty named volume: when the container starts, Docker copies the existing contents of /app/config from the image into the volume. The container sees the image's files. From then on, those files live in the volume. Docker only copies when the volume is empty. You can turn this copying off with the volume-nocopy option.

Bind mount: Docker copies nothing. A bind mount puts a host folder over the path. It hides the image's files, so the container sees an empty folder.

This surprises people in both directions:

• A volume filled by an old image version keeps the old files after you ship a new image. Docker only copies into an empty volume, so the new files never arrive.
• A bind mount can silently remove config files that the app expects.