The docker compose file is great, clear once you get used to all its little sections. For volumes I only use what they call “bind mounts” which are where you have a folder on your system connected to the folder in the container. As opposed to the “docker volumes” which are internal to docker.

And with those it’s super easy to just be like in the volume subsection:

- /path/to/local/drive:/container/database:rw,noexec,nosuid,nodev,Z

- /path/to/network/drive:/container/media:rw,noexec,nosuid,nodev,Z

The :rw,noexec,nosuid,nodev,Z at the end is a great extra security thing that never causes problems. rw means read-write, you can switch it to ro for read-only if you’ve got something you want the container to only read from but not be able to modify. I use that for jellyfin’s media since I don’t want it doing anything but reading it. The noexec means don't let executables be run from the folder, never should happen so it just prevents a sick hack from being put in the folder and run. I forget what the others do but they’ve never been a bother. And Z means only one process can access the volume, you can switch it to lower case z to let multiple processes access the volume - and I’m not sure it does anything without SELinux going which I think only fedora does by default right now.

Enjoy the info dump!