I got the host ID throughrancher hosts, I got the container ID through rancher ps -c, and I know the path to the volume because I have the docker-compose.yml file. So that’s actually all doable.
A rancher cp that used Rancher’s container names instead of Docker’s container IDs would be nice but probably not necessary. It’s a shame that Docker itself doesn’t really support remove volume access and we have to do it this way, but at least this works!