Introduction

Docker logs can grow quietly and consume large amounts of disk, especially on hosts running many long-lived containers. If log growth is not monitored, you eventually hit disk pressure and unstable services. The most useful workflow is to list log size per container regularly, then apply log rotation and cleanup policies.

Understand Where Docker Logs Are Stored

With the default json-file logging driver, each container writes logs on the host filesystem. The typical path is under /var/lib/docker/containers. Each container directory contains a JSON log file named with the container ID and a -json.log suffix.

First check active logging driver:

docker info --format '{{.LoggingDriver}}'

If output is not json-file, file-path methods below may not apply directly.

List Log Sizes for All Containers

A practical command is to loop through containers, resolve log path, and print size.

1docker ps -aq | while read -r id; do
2  name=$(docker inspect --format '{{.Name}}' "$id" | sed 's#^/##')
3  log=$(docker inspect --format '{{.LogPath}}' "$id")
4
5  if [ -f "$log" ]; then
6    size=$(du -h "$log" | awk '{print $1}')
7  else
8    size="n/a"
9  fi
10
11  printf "%-40s %-25s %s\n" "$id" "$name" "$size"
12done

This gives a fast per-container view and works well during incident response.

Sort by Largest Logs First

When disk usage is already high, sort output by size so you can act quickly.

1docker ps -aq | while read -r id; do
2  name=$(docker inspect --format '{{.Name}}' "$id" | sed 's#^/##')
3  log=$(docker inspect --format '{{.LogPath}}' "$id")
4
5  if [ -f "$log" ]; then
6    bytes=$(stat -c%s "$log")
7    echo "$bytes $id $name $log"
8  fi
9done | sort -nr | head -20

This is useful for finding noisy services and misconfigured debug logging.

Build a Reusable Host Script

Put your checks in a script so operators run the same command every time.

1#!/usr/bin/env bash
2set -euo pipefail
3
4printf "%10s  %-25s  %s\n" "SIZE(MB)" "CONTAINER" "LOG_PATH"
5
6for id in $(docker ps -aq); do
7  name=$(docker inspect --format '{{.Name}}' "$id" | sed 's#^/##')
8  log=$(docker inspect --format '{{.LogPath}}' "$id")
9
10  if [ -f "$log" ]; then
11    mb=$(awk -v s="$(stat -c%s "$log")" 'BEGIN {printf "%.2f", s/1024/1024}')
12    printf "%10s  %-25s  %s\n" "$mb" "$name" "$log"
13  fi
14done | sort -nr

Save this as /usr/local/bin/docker-log-sizes.sh, make it executable, and run with sudo if required.

Add Rotation to Prevent Repeated Growth

Inspection alone is reactive. Prevent repeated incidents with daemon log rotation.

Example /etc/docker/daemon.json:

1{
2  "log-driver": "json-file",
3  "log-opts": {
4    "max-size": "10m",
5    "max-file": "5"
6  }
7}

Apply with daemon restart:

sudo systemctl restart docker
sudo systemctl status docker --no-pager

This limits unbounded growth while preserving recent logs for debugging.

Optional Container-Specific Logging Config

If one container needs special retention, set logging options per container or Compose service rather than changing host-wide defaults.

Compose example:

1services:
2  api:
3    image: my-api:latest
4    logging:
5      driver: json-file
6      options:
7        max-size: "20m"
8        max-file: "3"

This allows high-volume services to use stricter settings without affecting all workloads.

Monitoring and Alerting

For production hosts, pair scripts with disk alerts. Useful signals include root filesystem usage percentage, total Docker log directory size, and largest single log file. Alert early, before cleanup becomes urgent.

Common Pitfalls

• Assuming all containers use json-file and skipping logging-driver checks.
• Deleting log files manually while daemon is writing to them.
• Monitoring only running containers and ignoring stopped ones with large logs.
• Rotating logs too aggressively and losing needed debug history.
• Forgetting to restart Docker after daemon config changes.

Summary

• Inspect Docker log size per container regularly to avoid disk surprises.
• Use container inspect data to map IDs to names and log file paths.
• Sort by size to prioritize cleanup and remediation.
• Configure daemon or service-level log rotation for prevention.
• Combine log-size checks with host-level monitoring and alerts.