14.1.2.3 Production Log Handling

Production log handling ensures a container's log output is properly captured, appropriately bounded in size, and ultimately routed somewhere genuinely useful for monitoring and debugging — rather than left unmanaged, where it could either fill up disk space or simply be lost entirely.

Configuring a Bounded Logging Driver

Docker's default json-file logging driver, without explicit size limits, can grow unbounded, eventually consuming significant disk space.

services:
  app:
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

This caps log storage at three files of ten megabytes each, automatically rotating and discarding the oldest once that limit is reached.

Why Container Logs Should Be Treated as Ephemeral

Since a container's logs typically don't persist beyond that container's own lifecycle (unless explicitly forwarded elsewhere), relying on them as a long-term record is inherently fragile.

docker logs myapp --since 1h

This shows recent logs for a currently running container, but that history disappears entirely once the container is removed, unless it's been forwarded to an external system.

Forwarding Logs to a Centralized Logging System

A production deployment typically forwards logs to a centralized system, providing durable storage, search, and correlation across multiple containers and services.

services:
  app:
    logging:
      driver: gelf
      options:
        gelf-address: "udp://logging.example.com:12201"

Writing Structured, Machine-Parseable Log Output

Structured (typically JSON) log output is considerably easier for a centralized logging system to parse, search, and correlate than unstructured plain text.

{"level": "error", "message": "database connection failed", "timestamp": "2026-06-24T10:00:00Z"}

Why Production Log Handling Matters

Properly bounding local log storage and forwarding logs to a durable, centralized system, ideally in a structured format, is essential for production logs to actually be useful for debugging and monitoring, rather than being lost or left to consume unbounded disk space.