Container Logging Best Practices

By Admin · Mar 27, 2026 · Updated Apr 23, 2026 · 650 views · 2 min read

The Problem

Containers are ephemeral — when they restart, logs disappear. You need a strategy for capturing, storing, and searching logs.

Docker Logging Drivers

// /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

Driver	Description	Best For
`json-file`	Default, local JSON files	Development, single server
`journald`	Integrates with systemd	Servers using journalctl
`syslog`	Send to syslog server	Centralized logging
`fluentd`	Send to Fluentd/Fluent Bit	Production aggregation
`none`	Disable logging	High-throughput services

Application Logging Rules

1. Log to stdout/stderr

# Good — Docker captures this automatically
import logging
logging.basicConfig(level=logging.INFO, stream=sys.stdout)
logger.info("Request processed", extra={"user_id": 123, "duration_ms": 45})

// Good
console.log(JSON.stringify({ level: "info", msg: "Request processed", userId: 123 }));

2. Use Structured Logging (JSON)

{"timestamp":"2026-03-15T10:30:00Z","level":"info","msg":"Request processed","user_id":123,"duration_ms":45,"path":"/api/users"}

Benefits:

Machine-parseable
Searchable by any field
Easy to aggregate and visualize

3. Include Context

Every log entry should include:

Field	Purpose
`timestamp`	When it happened
`level`	Severity (debug, info, warn, error)
`msg`	Human-readable description
`request_id`	Trace a request across services
`service`	Which service produced it
`duration_ms`	For performance tracking

Viewing Logs

# Follow a service's logs
docker compose logs -f app

# Last 100 lines
docker compose logs --tail 100 app

# With timestamps
docker compose logs -t app

# Since a specific time
docker compose logs --since 2026-03-15T10:00:00 app

Centralized Logging Stack

For production, aggregate logs to a central system:

# Lightweight: Fluent Bit → storage
services:
  fluent-bit:
    image: fluent/fluent-bit:latest
    volumes:
      - ./fluent-bit.conf:/fluent-bit/etc/fluent-bit.conf
      - /var/lib/docker/containers:/var/lib/docker/containers:ro

Warning Without log rotation, a verbose container can fill your disk in hours. Always set max-size and max-file limits.