Docker Container Logs Location: A Comprehensive Guide

Estimated reading time: 6 minutes

Last updated on May 1st, 2024 at 11:02 am

Docker Container Logging Overview

Docker is an important tool for developers and DevOps professionals. Docker provides efficient container management technology to build, ship, and run lightweight application containers.

When the application runs in the container it’s isolated and troubleshooting is crucial that is why container logs are important to know what’s going on inside the container.

But where are the Docker container logs are stored? The answer is simple it is stored below the path:

/var/lib/docker/containers/container_id/container_id-json.log

Let’s deep-dive into the comprehensive guide to understanding the Docker container logs location across the various platforms.

Where is the Default Docker Container Logs Location?

The Docker container automatically sends the logs to the host systems.

Technically, Docker containers are stateless, you lose the logs when the container is restarted or destroyed. Docker offers various logging drivers like syslog, journald, fluentd, or logagent for storing the logs outside the container.

Why Docker container logs are stored in JSON files?

By default, It uses the json-file logging driver.

Where Can I Find the Logs?

Depending on your Docker container logs driver you can find the logs in the appropriate location. The Docker container sends logs to the STDOUT STDERR streams.

By default, the Docker container puts the logs in a single container logs file. Simple rule: one log file per container.

You can find the Docker container logs location at /var/lib/docker/containers/. Check the below format for the detailed path:

/var/lib/docker/containers/container_id/container_id-json.log

Docker Container Logs Location Across Platforms

Linux 🐧

You can find the Docker container log location on the Linux system in the below directory:

/var/lib/docker/containers/container_id/container_id-json.log

It’s a common directory to store information about the containers on the host system. Each container has its subdirectory under the above main path, followed by the container IDs.

For example, if you have nginx container running with an ID 5f7e28b93a2c you can find the relevant directory at:

/var/lib/docker/containers/5f7e28b93a2c/

Depending on the Docker configuration, typically you can find the container.log, config.v2.json and hostconfig.json. But as mentioned it depends on Docker configuration about logging driver.

dev@devops:/var/lib/docker/containers/5f7e28b93a2c# ls -l
total 32
-rw-r----- 1 root root    0 Mar  6 07:24 5f7e28b93a2c-json.log
-rw------- 1 root root 2524 Mar 27 04:19 config.v2.json
-rw------- 1 root root 1462 Mar 27 04:19 hostconfig.json

MacOS 🍏

Similarly, on MacOS, Docker container logs are stored in the Docker environment. Due to differences in the filesystem structure, the exact location may vary slightly.

You can find the Docker container logs location under:

/var/lib/docker/containers/container_id/

Docker Desktop for Mac uses a Linux VM inside the macOS to run the Docker containers. It’s possible that the VM filesystem is not directly accessible from the macOS host system.

To view container logs using the Docker Desktop interface:

1. Open Docker Desktop.
2. Navigate to the “Containers/Apps” section.
3. Find the container you’re interested in and click on it.
4. In the container details view, you should see an option to view logs

Windows 🪟

On Windows systems, Docker container logs are stored in the Docker environment folder, typically in a directory structure similar to Linux and MacOS.

You can find the Docker container logs location at Root Dir in C drive in Windows

C:\ProgramData\docker\containers\container_id\container_id-json.log

You can view the logs for specific containers on Windows using the command

docker logs container_id

Windows 10 and WSL 2:

You can find the Docker container logs location if you use WSL 2 with Windows 10 at the below location:

/var/lib/docker/containers/container_id/container_id-json.log

You can also access the WSL 2 logs directly from the Windows explorer for the Docker Container Logs Location

\\wsl$\docker-desktop-data\version-pack-data\community\docker\containers

Advance Options for Docker Container Logs Location

Docker container logs provide the logs of all running containers. Let’s explore the available options for the Docker container logs:

docker ps
CONTAINER ID   IMAGE         COMMAND                  CREATED          STATUS         PORTS                  NAMES
abc123456789   nginx:latest  "nginx -g 'daemon of…"   5 minutes ago    Up 5 minutes   80/tcp, 443/tcp        web_server

Find individual container logs:

You can check the individual container logs with the container ID using docker logs <container_id>

docker logs abc123456789

Find real-time container logs:

if you want the logs tailing up in real time you can use the additional Docker option --follow or -f

docker logs -f abc123456789

Get the N number of lines from logs:

You can also grab a couple of lines from the logs with the –tail command followed by N for a number of lines.

docker logs --tail 10 abc123456789

Get the timestamp of logs:

You can get timestamps along with the container log lines with passing --timestamp or -t option

docker logs -t abc123456789

Get extra details from logs:

You can grab extra log details by passing the --details option:

docker logs --details abc123456789

Use grep with container logs:

You can combine the grep with the docker container log output to find the specific things:

docker logs abc123456789 | grep -i error

Docker Compose logs:

You can also check the Docker Compose logs with the service name. The service name is optional if you don’t specify it will print logs from all other services.

docker-compose logs nginx

Conclusion

In this blog, we understand Docker container log locations and how to access them across various platforms. We check various Docker logging drivers and learn about the default json-file driver.

We also learn advanced troubleshooting by using different options with docker logs. Accessing real-time logs, and extracting specific errors from logs using commands or finding Docker Compose service logs.

You can also check out the additional Docker Container Naming Convention Best Practices

If you’re looking for how to make your Docker container secure check out the Docker Container Security Cheatsheet and don’t get hacked🔐