And what happens when you launch new container from the same image? You need to run apt-get/yum again. Or rebuild image.

That's why you keep everything with state in a separate volume container. Attach volume to built image and that's it.

You can, if you want, mount your root as readonly so you're not tempted to modify it. Then it behaves like a Live CD.

Mount data, logs, configuration, eventual extensions in the data container?

For pg, there might be some migration needed when jumping from a major version to the next. Which requires both versions installed, on Debian at least.

>Mount data, logs, configuration, eventual extensions in the data container?

Many programs have their state represented as files that are stable across versions. If you have a cluster of the same image with different states it's more efficient to move volume containers across a network. Easier to backup/upgrade too.

pg is going to give you those problems whether you are using Docker or not.

and that defeats the whole selling point of docker, which is no forward config, containers do not change once shipped.

Worse, doing this breaks your guarantee that all environments deployed from this image will be consistent. You'll have to deploy some config management software (Puppet/Chef/Salt/Ansible) to stay on top of these changes.