Default: the container is stopped, its configuration files under /var/lib/docker are rewritten after a password prompt, the Docker service restarts and the container comes back as it was; no copy, no extra disk. Checked: the container is committed and re-created with the new setting instead (no password; a snapshot image per change stays).