The default with nothing set
No rotation at all, and the disk it fills is the one the daemon needs
json-file
Docker Logging Driver Generator
Set up container logging that does not fill the disk. The default driver has no rotation at all, which is the commonest way a Docker host stops working.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Generate. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A collector-shipping driver
Blocks the application when the collector is unreachable, unless async is on
fluentd
Rotation configured
Capped, and the cap is per container rather than per host
json-file max-size: 50m max-file: 5
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Leaving json-file at its defaults
There is no rotation. The logs grow until the Docker partition is full, at which point the daemon itself stops working rather than just that container.
Instead:Set max-size and max-file in /etc/docker/daemon.json so it applies to everything, then recreate the containers.
Emptying a log file to reclaim disk
The container holds the file open, so the space is not released until the process closes it or the container is removed.
Instead:Recreate the container, or restart the daemon after fixing the rotation settings.
Setting the driver in daemon.json and expecting running containers to change
The configuration is fixed when a container is created. Restarting changes nothing.
Instead:docker compose up -d --force-recreate, and verify with docker inspect.
The failure is not lost logs, it is a dead host
json-file writes under the Docker data root. When that partition fills, the daemon cannot write its own state either, so containers stop, new ones will not start, and docker commands begin failing.
Truncating the file does not free the space
The container holds it open, so the inode stays allocated until the process closes it or the container is removed. The classic recovery of emptying the log with a redirect frees nothing and looks like it worked.
The cap is per container
max-size 10m with max-file 3 caps each container at about 30 MiB. Fifty containers is a gigabytes and a half, which is the number to compare against the partition, and the one people work out afterwards.
local is the better default on a standalone host
It rotates by default at 20 MiB across five files and stores logs more compactly, and docker logs works identically. The only cost is that the on-disk format is not JSON, so anything reading the files directly has to change.
Some drivers block when the collector is down
fluentd is the notable one: by default the daemon blocks when it cannot reach the collector, so writes to stdout block and the application stops. fluentd-async=true buffers instead. syslog is different again: the daemon keeps no local copy, so docker logs returns nothing and an unreachable endpoint means the logs are simply gone.
Changing daemon.json does not touch existing containers
The logging configuration is fixed at creation, so restarting the daemon or the containers changes nothing. They have to be recreated, which is why the setting so often appears to have done nothing at all.
Only stdout and stderr are captured
An application writing to a file inside the container is invisible to every driver, and that file grows in the writable layer where nothing rotates it. This is why the official nginx image symlinks its logs to /dev/stdout.
More docker tools
Docker Container Image Reference Parser Is that a registry or a Docker Hub user? Dockerfile Linter What this image will do to you later docker run to Kubernetes YAML And the flags that have no equivalent Docker Compose to Kubernetes And why depends_on has no equivalent Dockerfile Non-Root USER Generator Numeric, or Kubernetes rejects it Docker OCI Image Labels Generator One of them actually does something Docker Hub Pull Rate Limit Calculator Counted per IP, not per person Docker Registry Storage Calculator Deleting a tag frees nothing Docker Build Context Analyzer All of it uploads before anything runs Docker Compose to docker run Converter Names stop resolving Docker Compose Version Migrator version: is obsolete now Docker Compose Network and Port Viewer Everything reaches everything Docker Command Explainer Which flags hand over the host Docker BuildKit Cache Mount Generator apt deletes the cache you just mounted Docker BuildKit Secret Mount Generator ARG is in docker history forever Docker .dockerignore Pattern Tester *.log does not match logs/app.log Docker Image Manifest Viewer unknown/unknown is not broken Docker Image Config Viewer Anyone who can pull can read your Env Docker Registry Token Decoder Check the scope before the credentials Docker HEALTHCHECK Generator Docker does nothing when it fails Docker Network Subnet Calculator 31 networks, then it stops Docker History Analyzer The rm did not save anything Docker Run to Compose Converter Some flags have no equivalent Docker CMD and ENTRYPOINT Tester Why docker stop takes ten seconds Docker Port Mapping Tester -p reaches past your firewall Docker -v to --mount Converter -v invents missing directories Docker Restart Policy Simulator The backoff resets after ten seconds Docker Exit Code Explainer 137 is two different problems Docker CPU Limit Converter --cpu-shares limits nothing Docker Memory Limit Calculator -m 512m allows a gigabyte Docker Compose Interpolation Tester An unset variable is an empty string Docker Environment Variable Precedence Tester Your shell does not reach the container Docker Compose Override Merge Previewer An override can add a port, never remove one Dockerfile Multi-Stage Build Analyzer Which stages reach the image Dockerignore Validator It is not .gitignore