1/3

Understanding Docker Logging

+15 XP on completion

#Understanding Docker Logging

After this lesson you'll know:

how docker logs works
the different logging drivers
how to configure log rotation
what structured logging is

#docker logs — the first place to check

When something goes wrong, docker logs is your best friend:

# Show container logs
docker logs container-name

# Last 50 lines only
docker logs --tail 50 container-name

# Follow logs live (like tail -f)
docker logs -f container-name

# With timestamps
docker logs -t container-name

#Logging Drivers — where do logs go?

Docker supports different logging drivers that determine where container logs are written:

Driver	Description	Use Case
`json-file`	Default, writes JSON logs to disk	Local development
`local`	Space-efficient, custom rotation	Production
`journald`	Send logs to systemd-journal	Linux hosts with systemd
`syslog`	Send to Syslog server	Legacy environments
`gelf`	Graylog Extended Log Format	Graylog / ELK Stack
`fluentd`	Send to Fluentd collector	Centralized log aggregation
`awslogs`	Directly to AWS CloudWatch	AWS production
`none`	No logs — writes to nowhere	Debugging only

# Set driver globally for Docker daemon (daemon.json)
# /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

# Driver per container
docker run --log-driver local --log-opt max-size=5m nginx

#Log Rotation — or Docker will eat your disk

Without rotation, logs grow indefinitely. An out-of-control container log can fill your entire disk:

# In daemon.json (global for all containers)
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",   # Max 10 MB per log file
    "max-file": "3"      # Keep max 3 old log files
  }
}

# In docker-compose.yml (per service)
services:
  web:
    image: nginx
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

#Structured Logging — machine-readable

docker logs outputs plain text. If you collect logs centrally (e.g., ELK or Grafana Loki), you need structured logs — ideally JSON:

// ❌ Unstructured
console.log("User 4711 logged in");

// ✅ Structured (machine-readable)
console.log(JSON.stringify({
  event: "login",
  userId: 4711,
  timestamp: new Date().toISOString(),
  level: "info"
}));

#✋ Try it out

# Start an Nginx container and check its logs
docker run -d --name logtest -p 8081:80 nginx
curl http://localhost:8081
docker logs logtest
docker logs --tail 5 logtest

# Use local logging driver with rotation
docker run --log-driver local --log-opt max-size=1m --name logtest2 alpine sh -c "while true; do echo 'log'; done"
# Check /var/lib/docker/containers/ — can you see the rotated logs?
docker rm -f logtest logtest2

#📌 Summary

docker logs is the first place to check for troubleshooting
The logging driver determines where logs are written
Always set max-size and max-file to prevent disk overflow
Structured JSON logs are the foundation for log aggregation

Container Monitoring & Metrics

← → to navigate