Managing Docker Container Logs: Mechanisms, Size Inspection, and Cleanup Strategies

When checking Docker container logs with docker logs <container_name>, large log files can consume disk space, so it is important to understand Docker's logging mechanism.

Docker daemon captures STDOUT/STDERR and forwards them to a log driver. Supported drivers include none, local, json-file, syslog, journald, gelf, fluentd, awslogs, splunk, etwlogs, gcplogs, logentries, etc.

The default driver is json-file, which stores logs as JSON lines under

/var/lib/docker/containers/{container_id}/{container_id}-json.log

. Its options such as max-size and max-file control file rotation.

To inspect log sizes you can run a shell script that finds all *-json.log files and lists their sizes, or filter by a specific container ID.

Removing logs with rm -rf does not free space while the file is still open; instead truncate the file with cat /dev/null > *-json.log or run a cleanup script that empties each log file.

For a permanent solution, start containers with log options --log-opt max-size=10m --log-opt max-file=3 (or at least max-size) to limit log growth.

By applying these practices, Docker log files can be managed effectively, preventing disk exhaustion.