How does Docker handle logging and how do you view container logs?
Learn how Docker captures container stdout/stderr, which logging drivers exist, and how to view, follow, and rotate logs with docker logs commands.
Expected Interview Answer
Docker captures whatever a container writes to stdout and stderr and hands it to a configurable logging driver; you view that output with `docker logs <container>`, and stream it live with `docker logs -f`.
By default Docker uses the `json-file` driver, which writes each line as JSON to a file on the host under /var/lib/docker/containers. You can switch drivers (json-file, local, journald, syslog, fluentd, awslogs, gelf) per container or globally in daemon.json, and add rotation limits like max-size and max-file so logs never fill the disk. Applications should log to stdout/stderr rather than to files inside the container, so Docker and downstream aggregators can collect everything uniformly.
- Centralized, uniform capture of stdout/stderr
- Pluggable drivers route logs to files, journald, or remote aggregators
- Built-in rotation prevents disk exhaustion
- Live tailing and time filtering aid debugging
- Works the same across images without app-specific config
AI Mentor Explanation
Think of the match commentator's microphone feed. Every word a player shouts on the pitch (stdout and stderr) is picked up by one central feed rather than scattered notebooks. The broadcaster decides where that feed goes — the stadium speakers, a radio channel, or a recorded archive — just as a logging driver routes container output to files, journald, or a remote aggregator you replay later.
Step-by-Step Explanation
Step 1
Log to stdout/stderr
Have the application write to standard streams rather than files inside the container so Docker can capture it.
Step 2
Docker captures the stream
The daemon intercepts stdout/stderr and passes each line to the configured logging driver.
Step 3
Driver stores or forwards
The default json-file driver writes to /var/lib/docker/containers/<id>/<id>-json.log; other drivers forward to journald, syslog, or remote systems.
Step 4
View the logs
Run `docker logs <container>` to dump history, add `-f` to follow, `--tail N` for the last N lines, and `--since`/`--until` for a time window.
Step 5
Configure rotation
Set max-size and max-file in daemon.json or per-container so logs rotate and never fill the disk.
What Interviewer Expects
- Understanding that Docker captures stdout/stderr, not app log files
- Knowledge of json-file as the default driver and where logs live
- Familiarity with alternative drivers (journald, syslog, fluentd, awslogs)
- The docker logs command and useful flags (-f, --tail, --since)
- Awareness of log rotation and disk-usage risks
Common Mistakes
- Assuming docker logs works with any driver (it only works with json-file/local/journald)
- Writing logs to files inside the container instead of stdout/stderr
- Forgetting to configure rotation, letting json-file logs fill the disk
- Confusing container logs with the Docker daemon's own logs
- Not knowing docker logs shows nothing for the remote drivers like awslogs
Best Answer (HR Friendly)
“Docker automatically records whatever a container prints out, and you read it back with the command `docker logs`. You can also send those logs to other systems and set limits so they don't fill up the disk.”
Code Example
# Dump all logs for a container
docker logs my-app
# Follow (tail) new log lines in real time
docker logs -f my-app
# Last 100 lines, with timestamps, since 10 minutes ago
docker logs --tail 100 --timestamps --since 10m my-app{
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
}
}Follow-up Questions
- Why does `docker logs` return an error when using the awslogs or fluentd driver?
- How would you centralize logs from many containers across a cluster?
- What is the difference between the json-file and local logging drivers?
- How do you prevent container logs from filling up the host disk?
- Why is logging to stdout/stderr preferred over writing to files in the container?
MCQ Practice
1. What is Docker's default logging driver?
Docker uses the json-file driver by default, writing each log line as JSON to a file on the host.
2. Which command follows a container's logs in real time?
docker logs -f (follow) streams new log lines as they are produced, similar to tail -f.
3. Where should a containerized application send its logs for Docker to capture them?
Docker captures the container's stdout and stderr streams; apps should log there so the driver can collect the output.
Flash Cards
What streams does Docker capture for logs? — stdout and stderr of the container's main process.
Default Docker logging driver? — json-file, which writes JSON lines under /var/lib/docker/containers.
Command to view container logs? — docker logs <container>; add -f to follow, --tail N, --since/--until for time filters.
How do you stop json-file logs filling the disk? — Set max-size and max-file log-opts to enable rotation.
Do remote drivers support docker logs? — No — drivers like awslogs, fluentd, and gelf don't support docker logs (json-file, local, and journald do).