I tried many solutions, but then ultimately ended up creating my own version which works.

version: '3.8'

services:
  vault:
    image: hashicorp/vault:latest
    container_name: vault
    restart: unless-stopped
    environment:
      VAULT_ADDR: "https://127.0.0.1:8200"
      VAULT_API_ADDR: "https://127.0.0.1:8200"
      VAULT_LOCAL_CONFIG: |
        {
          "listener": [
            {
              "tcp": {
                "address": "0.0.0.0:8200",
                "tls_disable": 0,
                "tls_cert_file": "/vault/config/certs/vault-cert.pem",
                "tls_key_file": "/vault/config/certs/vault-key.pem"
              }
            }
          ],
          "storage": {
            "file": {
              "path": "/vault/data"
            }
          },
          "default_lease_ttl": "168h",
          "max_lease_ttl": "720h",
          "ui": true
        }
    ports:
      - "8200:8200"
    volumes:
      - "<CUSTOM_USER_DIRECTORY>/data:/vault/data"
      - "<CUSTOM_USER_DIRECTORY>/certs:/vault/config/certs"
    cap_add:
      - IPC_LOCK
    command: "vault server -config vault/config/local.json"

Notice that I used the <CUSTOM_USER_DIRECTORY> which can be any directory on your system. I mapped these directories as I wanted to backup data using the backup service running and taking regular differential snapshots of the directory.

Also, in my case, I had to assign correct permissions to the directory I mentioned above.

sudo chown -R 100:100 <CUSTOM_USER_DIRECTORY>
sudo chmod -R 770 <CUSTOM_USER_DIRECTORY>

Also notice that I'm not running a dev env. It is using TLS. For that, I am using the mkcert tool for generating the TLS certificate inside the certs directory. It can creates certificate even for localhost. Here's what i created for.

mkcert 127.0.0.1

It created a certificate valid for 3 years. Good enough for me.

Now, if you created the certificate afte you assigned the permissions, notice that you'd have to make sure the certificates also have the correct permissions.

Only issue with this approach is, cli access is not valid anymore. It throws an error saying, "tls: failed to verify certificate: x509: certificate signed by unknown authority"

But, I'm using nginx as the load-balancer and mapped a domain to https://127.0.0.1:8200. (Notice the https here also).

Finally, the access via the domain works and it is TLS encrypted. First time, it shows the initialize UI screen also. Works perfectly well.