KodeKloud Notes

In Docker, logging drivers determine how container and service logs are captured, formatted, and stored. By choosing the right logging driver, you can centralize logs, integrate with external systems, and manage log retention efficiently. You can always view a container’s output with:

docker logs <container-name>

but behind the scenes the logging driver dictates where and how those logs are persisted.

The image features the text "Logging Drivers" on a dark background with abstract circular shapes and a wavy purple and blue design at the bottom.

What Is the Default json-file Logging Driver?

Docker’s default logging driver is json-file. It collects container output and writes it as JSON objects on the host filesystem.

To confirm your daemon’s default driver:

docker system info

Look for:

Server:
  ...
  Logging Driver: json-file
  Cgroup Driver: cgroupfs
Plugins:
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog

Run and inspect logs under json-file:

docker run -d --name nginx nginx
docker logs nginx

Sample output:

/docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
/docker-entrypoint.sh: Configuration complete; ready for start up

Where Are json-file Logs Stored?

By default, log files are stored under /var/lib/docker/containers/<container-id>. Each container directory contains a file named <container-id>-json.log:

docker ps
cd /var/lib/docker/containers
ls
cat f3997637c0df66becf4dd4662d3c172bf16f916a3b9289b95f0994675102de17-json.log

Note

Rotating or cleaning up old JSON logs prevents disk exhaustion. Consider using Docker’s log-opts settings like max-size and max-file.

Supported Docker Logging Drivers

Beyond json-file, Docker integrates with multiple logging backends. Choose the one that matches your infrastructure for centralized log aggregation:

Driver	Use Case	More Info
awslogs	Send logs to Amazon CloudWatch Logs	AWS CloudWatch Logs
fluentd	Forward logs to a Fluentd collector	Fluentd
gcplogs	Ship logs to Google Cloud Logging	Google Cloud Logging
gelf	Graylog Extended Log Format	GELF Specs
journald	Use systemd’s journald	journald
splunk	Forward to Splunk	Splunk Docs
syslog	Standard syslog protocol	—
local	Fast, built-in local driver	—
none	Disable logging (no `docker logs`)	—

Warning

Using the none driver disables all logs for the container. Only use this when you intentionally want zero log output.

Changing the Daemon’s Default Logging Driver

To set a different default logging driver, modify (or create) /etc/docker/daemon.json:

{
  "log-driver": "awslogs",
  "log-opts": {
    "awslogs-region": "us-east-1"
  }
}

If you need TLS, custom hosts, or debug mode, include those settings alongside:

{
  "debug": true,
  "hosts": ["tcp://0.0.0.0:2376"],
  "tls": true,
  "tlscert": "/var/docker/server.pem",
  "tlskey": "/var/docker/serverkey.pem",
  "log-driver": "awslogs",
  "log-opts": {
    "awslogs-region": "us-east-1"
  }
}

Restart Docker to apply changes:

sudo systemctl restart docker

Overriding the Logging Driver Per Container

You can override the daemon default for individual containers with the --log-driver flag:

docker run -d \
  --name myapp \
  --log-driver=fluentd \
  nginx

Add driver-specific options via --log-opt:

docker run -d \
  --name myapp \
  --log-driver=fluentd \
  --log-opt fluentd-address=localhost:24224 \
  nginx

Inspecting a Container’s Logging Configuration

To verify which logging driver a container is using:

docker container inspect nginx

Search for the HostConfig.LogConfig section:

"HostConfig": {
  "LogConfig": {
    "Type": "json-file",
    "Config": {}
  }
}

For a concise output with a Go template:

docker container inspect -f '{{.HostConfig.LogConfig.Type}}' nginx

This prints only the driver name.

Links and References

Watch Video

Watch video content