From f7030feba7b9e6070b886ccf9bae9d451d6dff28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sun, 25 Oct 2026 13:12:44 +0100 Subject: [PATCH] docs(ops): say that the pre-upgrade volume keeps data erasure never reaches The Postgres major-upgrade guide suggested removing the old pgdata volume "when you are sure". That volume is a full copy of the database as it stood before the move: account deletions, trash purges and key rotations after it never reach it. The guide now says so and makes removing it part of the move. --- docs/ops/postgres-major-upgrade.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/ops/postgres-major-upgrade.md b/docs/ops/postgres-major-upgrade.md index 58af2d6c4..e856dc33f 100644 --- a/docs/ops/postgres-major-upgrade.md +++ b/docs/ops/postgres-major-upgrade.md @@ -58,9 +58,13 @@ Anything written after the move lives only in the Postgres 18 volume. ## Afterwards -Keep the old volume until the new database has run for a while. When you are -sure, remove it (`docker volume ls` shows its full name, prefixed with the -compose project): +Keep the old volume until the new database has run for a while, then remove +it. It is a complete copy of the database as it stood before the move, and +nothing that happens afterwards reaches it: an account deleted, a document +purged from the trash, or a key rotated after a leak is still there in the +old volume, and so is everything else for anyone who can read the host's +Docker volumes. Removing it is part of the move, not optional tidying. +`docker volume ls` shows its full name, prefixed with the compose project: ```bash docker volume rm _pgdata