Docker Logs and Log Drivers

By default, Docker stores logs without any size limit. A busy container can fill an entire disk with log files. This lesson covers how to view logs, configure rotation, and choose the right log driver.

Viewing Logs

# Last 100 lines
docker logs --tail=100 my-container

# Follow logs in real-time
docker logs -f my-container

# Logs from the last 15 minutes
docker logs --since=15m my-container

# Logs for a Compose service
docker compose logs -f api

The Default Problem

Docker's default log driver (json-file) has no size limits:

flowchart LR
    App["Container stdout/stderr"] --> Log["json-file log<br/>/var/lib/docker/containers/..."]
    Log -->|"No rotation"| Disk["Disk fills up"]
    Disk --> Fail["Host crashes"]

    style Disk fill:#ffebee,stroke:#c62828
    style Fail fill:#ffebee,stroke:#c62828

A single container can generate gigabytes of logs and take down your entire host.

Configuring Log Rotation (Fix This First)

Add log rotation to /etc/docker/daemon.json to apply it globally to all containers:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

Then restart Docker:

sudo systemctl restart docker

Setting	Meaning
max-size: 10m	Each log file can be at most 10 MB
max-file: 3	Docker keeps at most 3 rotated files
Total per container	30 MB maximum log storage

Restart Required

Changes to daemon.json only apply to new containers. Existing containers keep their old settings. Recreate them to pick up the new defaults.

Per-Container Override

Override the global default for specific containers:

docker run -d \
  --log-opt max-size=50m \
  --log-opt max-file=5 \
  my-app:1.0.0

In Compose:

services:
  api:
    image: my-api:1.0.0
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

Available Log Drivers

Driver	Where Logs Go	Use Case
json-file	Local JSON files	Default, good for most setups with rotation
local	Optimized local storage	Better compression, newer Docker versions
syslog	System syslog	Integration with host logging infrastructure
journald	systemd journal	Systems using journald
fluentd	Fluentd collector	Centralized logging pipelines
none	Nowhere	Services where you truly want no logs

For most single-host setups, json-file with rotation is sufficient.

Checking Current Log Configuration

# See which log driver a container is using
docker inspect -f '{{.HostConfig.LogConfig.Type}}' my-container

# See the log options (rotation settings)
docker inspect -f '{{json .HostConfig.LogConfig.Config}}' my-container

Troubleshooting Disk Fills from Logs

If your host disk is full and you suspect logs:

# Find the largest log files
sudo du -sh /var/lib/docker/containers/*/*-json.log | sort -rh | head -5

# Check Docker disk usage
docker system df

If you find giant log files, the container was running without rotation. Fix daemon.json, then recreate the containers.

Key Takeaways

• Docker does not rotate logs by default. Configure max-size and max-file in daemon.json before anything else.
• Use docker logs --tail and --since to view specific time windows without overwhelming your terminal.
• Log rotation settings only apply to new containers -- recreate existing ones after changing daemon.json.
• For most setups, json-file with rotation is sufficient. Use centralized drivers (fluentd, syslog) for multi-host logging.
• Regularly check /var/lib/docker/containers/ for unexpectedly large log files.

What's Next

• Continue to Disk Usage and Cleanup to monitor and reclaim Docker disk space.