The default with nothing set
No rotation at all, and the disk it fills is the one the daemon needs
json-file
Docker Logging Driver Generator
Set up container logging that does not fill the disk. The default driver has no rotation at all, which is the commonest way a Docker host stops working.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Generate. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A collector-shipping driver
Blocks the application when the collector is unreachable, unless async is on
fluentd
Rotation configured
Capped, and the cap is per container rather than per host
json-file max-size: 50m max-file: 5
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Leaving json-file at its defaults
There is no rotation. The logs grow until the Docker partition is full, at which point the daemon itself stops working rather than just that container.
Instead:Set max-size and max-file in /etc/docker/daemon.json so it applies to everything, then recreate the containers.
Emptying a log file to reclaim disk
The container holds the file open, so the space is not released until the process closes it or the container is removed.
Instead:Recreate the container, or restart the daemon after fixing the rotation settings.
Setting the driver in daemon.json and expecting running containers to change
The configuration is fixed when a container is created. Restarting changes nothing.
Instead:docker compose up -d --force-recreate, and verify with docker inspect.
The failure is not lost logs, it is a dead host
json-file writes under the Docker data root. When that partition fills, the daemon cannot write its own state either, so containers stop, new ones will not start, and docker commands begin failing.
Truncating the file does not free the space
The container holds it open, so the inode stays allocated until the process closes it or the container is removed. The classic recovery of emptying the log with a redirect frees nothing and looks like it worked.
The cap is per container
max-size 10m with max-file 3 caps each container at about 30 MiB. Fifty containers is a gigabytes and a half, which is the number to compare against the partition, and the one people work out afterwards.
local is the better default on a standalone host
It rotates by default at 20 MiB across five files and stores logs more compactly, and docker logs works identically. The only cost is that the on-disk format is not JSON, so anything reading the files directly has to change.
Some drivers block when the collector is down
fluentd is the notable one: by default the daemon blocks when it cannot reach the collector, so writes to stdout block and the application stops. fluentd-async=true buffers instead. syslog is different again: the daemon keeps no local copy, so docker logs returns nothing and an unreachable endpoint means the logs are simply gone.
Changing daemon.json does not touch existing containers
The logging configuration is fixed at creation, so restarting the daemon or the containers changes nothing. They have to be recreated, which is why the setting so often appears to have done nothing at all.
Only stdout and stderr are captured
An application writing to a file inside the container is invisible to every driver, and that file grows in the writable layer where nothing rotates it. This is why the official nginx image symlinks its logs to /dev/stdout.
Related docker tools
Dockerfile Non-Root USER Generator Numeric, or Kubernetes rejects it Docker OCI Image Labels Generator One of them actually does something Docker BuildKit Cache Mount Generator apt deletes the cache you just mounted Docker BuildKit Secret Mount Generator ARG is in docker history forever Docker HEALTHCHECK Generator Docker does nothing when it fails Docker Container Image Reference Parser Is that a registry or a Docker Hub user?
All 36 docker tools