Docker Logging Driver — Where Container Logs Go
What Is a Docker Logging Driver in Simple Terms?
Every container writes output to stdout and stderr. The logging driver decides what happens to that output — writes it to a local JSON file, sends it to AWS CloudWatch, forwards it to a Fluentd aggregator, or discards it entirely.
The default driver (json-file) writes to /var/lib/docker/containers/*/ on the host. Without configuring log rotation, this directory fills up the disk over time. Configuring the logging driver correctly is one of the first things to do before running production workloads.
Available Logging Drivers
| Driver | Description | Use Case |
|---|---|---|
| json-file | Default. JSON files on host | Always configure with rotation |
| local | Compressed binary format | Better performance than json-file |
| awslogs | AWS CloudWatch Logs | AWS-based infrastructure |
| fluentd | Forward to Fluentd | ELK/EFK stack |
| journald | systemd journal | Linux hosts with systemd |
| splunk | Splunk HTTP Event Collector | Enterprise Splunk deployments |
| gelf | Graylog Extended Log Format | Graylog deployments |
| none | Discard all logs | Batch jobs, no logging needed |
Configuring Log Rotation (Do Immediately)
// /etc/docker/daemon.json — configure for ALL containers{ "log-driver": "json-file", "log-opts": { "max-size": "100m", "max-file": "3" }}// Rotates at 100MB, keeps 3 files = max 300MB per container# Apply without restarting containerssudo systemctl reload docker # Per-container overridedocker run -d \ --log-driver json-file \ --log-opt max-size=200m \ --log-opt max-file=5 \ payment-api:latest # In Docker Composeservices: api: logging: driver: json-file options: max-size: "100m" max-file: "3"AWS CloudWatch Logging
# Send logs directly to CloudWatchdocker run -d \ --log-driver awslogs \ --log-opt awslogs-region=ap-south-1 \ --log-opt awslogs-group=/production/payment-api \ --log-opt awslogs-stream=payment-api-$(hostname) \ registry.razorpay.in/payment-api:v3.1.0 # In Docker Composeservices: api: logging: driver: awslogs options: awslogs-region: ap-south-1 awslogs-group: /production/payment-apiImportant: `docker logs` Availability
# docker logs works with json-file and local driversdocker logs payment-api # docker logs does NOT work with awslogs, fluentd, splunk# Logs go directly to the remote system — no local copy# If you need docker logs for debugging, keep json-file as local fallback# Use Fluentd sidecar to ship logs AND keep local json-fileREMEMBER THIS**Remember:** Configure log rotation in `/etc/docker/daemon.json` before running any production workloads. Without rotation, a single busy API container generating logs at 10MB/day fills the disk in 100 days. With `max-size: 100m, max-file: 3`, maximum log storage per container is capped at 300MB forever.