Baza znanja

By default, Docker captures everything a container writes to stdout/stderr — but without proper log rotation, these can silently grow and fill your disk. This guide covers viewing, limiting, and centralizing container logs.

Viewing Logs for a Container

docker logs CONTAINER_NAME

Follow logs in real time:

docker logs -f CONTAINER_NAME

Show only the last 100 lines:

docker logs --tail 100 CONTAINER_NAME

Show logs since a specific time:

docker logs --since 1h CONTAINER_NAME

Viewing Logs for All Services in a Compose Project

docker compose logs -f

For a specific service only:

docker compose logs -f web

The Default json-file Driver

By default, Docker stores container logs as JSON files on the host, with no automatic size limit unless configured — this is the most common cause of a VPS disk unexpectedly filling up.

Setting Log Size Limits (Critical for Production)

Per container:

docker run -d \
  --log-opt max-size=10m \
  --log-opt max-file=3 \
  myimage

In Docker Compose:

services:
  web:
    image: myimage
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

This caps each container to 3 rotated log files of 10 MB each — 30 MB maximum, instead of unbounded growth.

Setting a Global Default for All Containers

sudo nano /etc/docker/daemon.json

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

sudo systemctl restart docker

Note this only applies to containers created after the change; existing containers must be recreated to pick up the new default.

Finding Which Container Is Filling Your Disk

sudo du -sh /var/lib/docker/containers/*/*-json.log | sort -hr | head -10

Centralizing Logs (Beyond a Single Server)

For multi-container or multi-server setups, consider a dedicated log driver or shipping logs to a central system:

logging:
  driver: syslog
  options:
    syslog-address: "udp://logserver:514"

Common Errors

Disk full, traced to Docker logs — apply the max-size/max-file limits above and truncate the offending log manually if urgent: sudo truncate -s 0 /var/lib/docker/containers/CONTAINER_ID/CONTAINER_ID-json.log.

Best Practices

• Always set log size limits in production — never rely on the unbounded default
• Check disk usage periodically, including /var/lib/docker specifically
• Use docker logs as your first troubleshooting step for any misbehaving container

FAQ

Does changing daemon.json affect running containers?
No — only newly created containers use the new default; existing ones must be recreated (e.g. via docker compose up -d --force-recreate).

Related Articles

• Docker Compose Troubleshooting: Common Errors & Fixes
• How to Check and Manage Disk Usage on a Linux VPS
• Docker Restart Policies and Healthchecks