Docker logging drivers - Step-by-Step Execution

Process Flow - Docker logging drivers

Start Container

↓

Container Writes Logs

↓

Docker Captures Logs

↓

Logs Sent to Logging Driver

↓

Logging Driver Processes Logs

↓

Logs Stored or Forwarded

↓

User Views Logs via Docker or External Tool

This flow shows how Docker captures container logs and sends them to the chosen logging driver, which then stores or forwards the logs for user access.

Execution Sample

Docker

docker run --log-driver json-file alpine echo hello

docker logs <container_id>

Run a container with the json-file logging driver and then view its logs.

Process Table

Step	Action	Logging Driver	Log Captured	Log Stored/Forwarded	User Output
1	Start container with --log-driver json-file	json-file	No logs yet	No logs yet	No output
2	Container runs command 'echo hello'	json-file	Captured 'hello\n'	Stored in json-file log	No output yet
3	User runs 'docker logs <container_id>'	json-file	Logs already captured	Logs read from json-file	Output: 'hello'
4	Container stops	json-file	No new logs	Logs remain stored	No output
5	Start container with --log-driver syslog	syslog	No logs yet	No logs yet	No output
6	Container runs command 'echo hello'	syslog	Captured 'hello\n'	Forwarded to syslog daemon	No output yet
7	User checks syslog externally	syslog	Logs forwarded	Logs stored in syslog	Output: 'hello' in syslog
8	User runs 'docker logs <container_id>'	syslog	Logs forwarded	Logs not stored locally	Output: empty
9	Container stops	syslog	No new logs	Logs remain in syslog	No output
10	Start container with --log-driver none	none	No logs captured	No logs stored or forwarded	No output
11	Container runs command 'echo hello'	none	No logs captured	No logs stored or forwarded	No output
12	User runs 'docker logs <container_id>'	none	No logs	No logs	Output: '' (empty)

💡 Execution stops after container stops or user finishes checking logs.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6	After Step 7	After Step 8	After Step 10	After Step 11	After Step 12
Logging Driver	json-file	json-file	json-file	json-file	syslog	syslog	syslog	none	none	none
Logs Captured	No logs	hello\n	hello\n	hello\n	hello\n	hello\n	hello\n	No logs	No logs	No logs
Logs Stored/Forwarded	No logs	Stored in json-file	Stored in json-file	Stored in json-file	Forwarded to syslog	Forwarded to syslog	Forwarded to syslog	No logs	No logs	No logs
User Output	No output	No output	hello	No output	No output	hello in syslog	empty	No output	No output	Empty

Key Moments - 3 Insights

Why does 'docker logs' show no output when using the syslog logging driver?

Because the syslog driver forwards logs to the system's syslog service and does not store logs locally for 'docker logs' to read, as shown in execution_table step 8.

What happens to logs when the 'none' logging driver is used?

No logs are captured, stored, or forwarded, so 'docker logs' returns empty output, as seen in execution_table steps 10-12.

How does the json-file logging driver handle logs?

It captures logs and stores them locally in JSON format, allowing 'docker logs' to display them, demonstrated in execution_table steps 2-3.

Visual Quiz - 3 Questions

Look at the execution table, at which step does the user see the output 'hello' using the json-file driver?

A Step 8

B Step 6

C Step 3

D Step 12

💡 Hint

Check the 'User Output' column for the json-file driver rows in the execution_table.

According to the variable tracker, what is the state of 'Logs Captured' after step 11 with the 'none' driver?

A No logs

B 'hello\n'

C Stored in json-file

D Forwarded to syslog

💡 Hint

Look at the 'Logs Captured' row under 'After Step 11' in variable_tracker.

If you switch from 'json-file' to 'syslog' driver, what changes in the 'User Output' when running 'docker logs'?

A Output becomes empty string

B Output changes from 'hello' to 'empty'

C Output remains 'hello'

D Output shows error message

💡 Hint

Compare 'User Output' for json-file at step 3 and syslog at step 8 in execution_table.

Concept Snapshot

Docker logging drivers control where container logs go.
Common drivers: json-file (default, stores locally), syslog (forwards to system), none (no logs).
Use --log-driver option when running containers.
'docker logs' works only if logs are stored locally.
Choose driver based on your log management needs.

Full Transcript

Docker logging drivers decide how container logs are handled. When a container runs, it writes logs. Docker captures these logs and sends them to the chosen logging driver. The driver either stores logs locally, forwards them to an external system, or discards them. For example, the json-file driver stores logs in a file, so 'docker logs' can show them. The syslog driver sends logs to the system's syslog service, so 'docker logs' may show no output. The none driver disables logging. Users select the driver with the --log-driver option when starting containers. Understanding this helps manage logs effectively.