Understanding Docker Log Types, Drivers, and Configuration for Production Environments

Docker logs are divided into engine logs (managed by systemd or upstart) and container logs (STDOUT/STDERR from services). Engine logs can be viewed via journalctl -u docker or the upstart file /var/log/upstart/docker.log on Ubuntu 14.04, and similar locations for other OSes.

1. Docker Engine Logs

Engine logs are stored by the init system. Use journalctl -u docker on systemd‑based systems or check /var/log/upstart/docker.log on older Ubuntu. The table below shows log locations for various distributions.

| System               | Log location
|----------------------|------------------------------------------------------------|
| Ubuntu(14.04)        | `/var/log/upstart/docker.log` |
| Ubuntu(16.04)        | `journalctl -u docker.service` |
| CentOS 7 / RHEL 7    | `journalctl -u docker.service` |
| CoreOS               | `journalctl -u docker.service` |
| OpenSuSE             | `journalctl -u docker.service` |
| OSX                  | `~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/log/docker.log` |
| Debian 7             | `/var/log/daemon.log` |
| Debian 8             | `journalctl -u docker.service` |
| Boot2Docker          | `/var/log/docker.log` |

2. Container Logs

2.1 Common command – docker logs

The docker logs CONTAINER command shows STDOUT and STDERR of a running container. It does not capture logs written directly to files inside the container.

NGINX official image links /var/log/nginx/access.log to /dev/stdout and /var/log/nginx/error.log to /dev/stderr . httpd writes to /proc/self/fd/1 (STDOUT) and /proc/self/fd/2 (STDERR). Heavy log volume can stress the Docker daemon. Only containers using the local , json-file , or journald drivers support docker logs .

2.2 Docker Log Drivers

Docker provides several drivers to route container logs. The default is json-file. Drivers include none, local, json-file, syslog, journald, gelf, fluentd, awslogs, splunk, etwlogs, gcplogs, logentries.

| Driver      | Description
|------------|-----------------------------------------------------------|
| none       | No logs are collected. |
| local      | Stores logs locally with minimal overhead. |
| json-file  | Default driver; stores logs in JSON format. |
| syslog     | Sends logs to a syslog server. |
| journald   | Sends logs to systemd‑journal. |
| gelf       | Sends logs to Graylog/GELF endpoint. |
| fluentd    | Sends logs to a fluentd daemon. |
| awslogs    | Sends logs to Amazon CloudWatch Logs. |
| splunk     | Sends logs to Splunk via HTTP. |
| etwlogs    | Windows Event Tracing logs (Windows only). |
| gcplogs    | Sends logs to Google Cloud Logging. |
| logentries | Sends logs to Rapid7 Logentries. |

Only the local, json-file, and journald drivers work with docker logs on Docker‑CE 18.09.6.

Log driver – local

The local driver records STDOUT/STDERR to

/var/lib/docker/containers/<container-id>/local-logs/container.log

. It keeps 100 MiB per container by default and supports options such as max-size, max-file, and compress.

| Option   | Description                     | Example
|----------|---------------------------------|---------------------------|
| max-size | Maximum size before rotation   | --log-opt max-size=10m   |
| max-file | Maximum number of files kept    | --log-opt max-file=3    |
| compress | Enable compression of rotated files | --log-opt compress=false |

Log driver – json-file

The default json-file driver stores logs as JSON objects containing the log line, stream, and timestamp. Logs are located at

/var/lib/docker/containers/<container-id>/<container-id>-json.log

. Options include max-size, max-file, labels, env, env-regex, and compress.

Log driver – syslog

Syslog driver forwards logs to a syslog server. Configuration is done in /etc/docker/daemon.json with options such as syslog-address, syslog-facility, tag, etc.

{
  "log-driver": "syslog",
  "log-opts": {
    "syslog-address": "udp://1.2.3.4:1111"
  }
}

Log driver – journald

The journald driver writes logs to the systemd journal. It adds fields like CONTAINER_ID, CONTAINER_NAME, and supports options tag, labels, env, and env-regex. Global configuration is also set in /etc/docker/daemon.json.

{
  "log-driver": "journald"
}

3. Storing Container Logs in Production

Two main log categories exist: standard‑output logs (captured by Docker drivers) and file‑based logs written inside the container. For file‑based logs, common solutions are:

Bind‑mount a host directory to the container log directory.

Use a Docker volume.

Determine the container’s rootfs mount point (e.g., overlay2 merged directory) and read logs directly from the host filesystem.

Write logs directly to external systems such as Redis → Logstash → Elasticsearch from the application code.

Choose the method that best fits the operational requirements.