A docker image can have its own volumes that are not defined at container creation (for instance, with the -v parameter of docker run), but when the image it built. That's what the VOLUME statement in a Dockerfile is for.
See also the relevant section of the documentation:
The VOLUME instruction creates a mount point with the specified name and marks it as holding externally mounted volumes from native host or other containers. The value can be a JSON array, VOLUME ["/var/log/"], or a plain string with multiple arguments, such as VOLUME /var/log or VOLUME /var/log /var/db. For more information/examples and mounting instructions via the Docker client, refer to Share Directories via Volumes documentation.
The docker run command initializes the newly created volume with any data that exists at the specified location within the base image. For example, consider the following Dockerfile snippet:
FROM ubuntu
RUN mkdir /myvol
RUN echo "hello world" > /myvol/greeting
VOLUME /myvol
If you have a look at the Dockerfile of the mysql image that you're (indirectly) referring to in your question, you'll see that /var/lib/mysql is defined as a volume. Every container created from that image will be created with that volume, even if not explicitly defined.
