Painless Docker - 2nd Edition

Understanding Docker Logs Internals

When people say "Docker logs", they usually mean the logs produced by containers. Strictly speaking, Docker itself doesn't generate application logs. Instead, Docker captures whatever a container writes to standard output (stdout) and standard error (stderr) and forwards those streams to a logging backend.

By default, Docker uses the json-file logging driver. With this driver, logs are written to:

/var/lib/docker/containers//-json.log

Each log entry is stored as a JSON object containing the message, timestamp, and stream (stdout or stderr).

Let's look at how to access these logs. Start a container from the nginx image and map port 8080 on the host to port 80 in the container:

docker run --name my_container -d -p 8080:80 nginx

Send multiple HTTP requests to generate log entries:

for i in {1..10}; do curl -s http://localhost:8080 > /dev/null; done

Retrieve the container ID (full version):

container_id=$(docker inspect --format='{{.Id}}' my_container)

Inspect the log file directly:

tail /var/lib/docker/containers/$container_id