Docker Logging: Collecting and Managing Container Logs

Default Logging

Docker captures stdout and stderr from containers and stores them as JSON files:

# View logs
docker logs mycontainer
docker logs -f mycontainer        # Follow
docker logs --tail 100 mycontainer # Last 100 lines
docker logs --since 1h mycontainer # Last hour

Log Driver Configuration

Configure the default log driver in /etc/docker/daemon.json:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

sudo systemctl restart docker

Available Log Drivers

Per-Container Override

docker run -d \
  --log-driver=json-file \
  --log-opt max-size=50m \
  --log-opt max-file=5 \
  myapp

Docker Compose Logging

services:
  app:
    image: myapp
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

Centralized Logging

For multi-container setups, ship logs to a central system:

• Promtail + Loki — lightweight, Grafana-native
• Fluentd + Elasticsearch — powerful, more complex
• Vector — modern alternative to Fluentd

Log Disk Usage

# Check how much space logs are using
docker system df -v | grep -A5 "CONTAINER"
du -sh /var/lib/docker/containers/*/