What is Docker Logging Driver? | DevOps Dictionary

Docker Logging Driver — Where Container Logs Go

What Is a Docker Logging Driver in Simple Terms?

Every container writes output to stdout and stderr. The logging driver decides what happens to that output — writes it to a local JSON file, sends it to AWS CloudWatch, forwards it to a Fluentd aggregator, or discards it entirely.

The default driver (json-file) writes to /var/lib/docker/containers/*/ on the host. Without configuring log rotation, this directory fills up the disk over time. Configuring the logging driver correctly is one of the first things to do before running production workloads.

Available Logging Drivers

Driver	Description	Use Case
json-file	Default. JSON files on host	Always configure with rotation
local	Compressed binary format	Better performance than json-file
awslogs	AWS CloudWatch Logs	AWS-based infrastructure
fluentd	Forward to Fluentd	ELK/EFK stack
journald	systemd journal	Linux hosts with systemd
splunk	Splunk HTTP Event Collector	Enterprise Splunk deployments
gelf	Graylog Extended Log Format	Graylog deployments
none	Discard all logs	Batch jobs, no logging needed

Configuring Log Rotation (Do Immediately)

JSON

// /etc/docker/daemon.json — configure for ALL containers
{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  }
}
// Rotates at 100MB, keeps 3 files = max 300MB per container

Bash

# Apply without restarting containers
sudo systemctl reload docker
 
# Per-container override
docker run -d \
  --log-driver json-file \
  --log-opt max-size=200m \
  --log-opt max-file=5 \
  payment-api:latest
 
# In Docker Compose
services:
  api:
    logging:
      driver: json-file
      options:
        max-size: "100m"
        max-file: "3"

AWS CloudWatch Logging

Bash

# Send logs directly to CloudWatch
docker run -d \
  --log-driver awslogs \
  --log-opt awslogs-region=ap-south-1 \
  --log-opt awslogs-group=/production/payment-api \
  --log-opt awslogs-stream=payment-api-$(hostname) \
  registry.razorpay.in/payment-api:v3.1.0
 
# In Docker Compose
services:
  api:
    logging:
      driver: awslogs
      options:
        awslogs-region: ap-south-1
        awslogs-group: /production/payment-api

Important: `docker logs` Availability

Bash

# docker logs works with json-file and local drivers
docker logs payment-api
 
# docker logs does NOT work with awslogs, fluentd, splunk
# Logs go directly to the remote system — no local copy
# If you need docker logs for debugging, keep json-file as local fallback
# Use Fluentd sidecar to ship logs AND keep local json-file

REMEMBER THIS
**Remember:** Configure log rotation in `/etc/docker/daemon.json` before running any production workloads. Without rotation, a single busy API container generating logs at 10MB/day fills the disk in 100 days. With `max-size: 100m, max-file: 3`, maximum log storage per container is capped at 300MB forever.