The way we did this at my old place of work 2 yrs ago, we ended up using an external database to write to and I think we used a shared path for a file mount (if one is required). Or you could possibly use a shared file path and store the database there as a persistent storage area. And when it came time for an update, we d/l the newer container (or made it with custom plugins) and ran it to test the update of the database structures and code.

I am going off memory here unfortunately. I do think we did it that way as a test. I would set it up locally using the OKD or whatever it is called now and test it out with different versions of the container based software to make sure the upgrade path works.

I did something similar in Docker Compose with Keycloak upgrading from 7.0 to 10.0 and it seemed to work once I understood the newer parameters / ENV to start it.