Log Drivers & Rotation

Logs Will Eat Your Disk (Unless You Say Otherwise)

Scenario: A container logged ten lines a second for six weeks. Its json-file log grew to 40GB, the disk filled, and every container on the node started failing. The postmortem action item: log rotation, everywhere, enforced.

By default Docker captures stdout/stderr to a json-file per container, unrotated and unbounded. Fix it per container:

$ docker run -d --log-driver json-file \
    --log-opt max-size=10m --log-opt max-file=3 myapp

…or for every container, in /etc/docker/daemon.json:

{ "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" } }

Driver	Sends logs to
`json-file`	local files (the default; what `docker logs` reads)
`local`	compact local format, rotation by default
`syslog` / `journald`	the host's log system
`fluentd` / `gelf` / `awslogs`	centralized log pipelines

Warning: With most non-default drivers, docker logs stops working (nothing local to read). Teams often keep json-file with rotation and ship logs with a sidecar/agent instead.