How does Docker handle logging?
Why Interviewers Ask This
Candidates at the intermediate level are expected to not only know this concept but explain the trade-offs involved. Interviewers use this question to see if you can reason about design decisions, not just recall facts.
Answer
Docker captures output from container's stdout and stderr and routes it through a logging driver. The default driver is json-file — logs are stored as JSON files on the host at /var/lib/docker/containers/<container-id>/<container-id>-json.log. Available drivers: json-file (default), syslog, journald, gelf (Graylog), fluentd, awslogs (CloudWatch), splunk, none. Configure globally in /etc/docker/daemon.json: {"log-driver": "json-file", "log-opts": {"max-size": "100m", "max-file": "3"}}. Per container: docker run --log-driver fluentd myapp. Log rotation is critical — without limits, json-file logs can fill the disk. Configure: --log-opt max-size=100m --log-opt max-file=3 (keeps last 3 files of 100MB each). Application best practice: write logs to stdout/stderr (not to files inside the container) — Docker captures and routes them. Commands: docker logs mycontainer; docker logs -f --tail 100 mycontainer. For production: use a log aggregation system — ship logs to Elasticsearch (via Fluentd/Logstash), CloudWatch, Datadog, or Splunk. docker compose logs -f combines logs from all services with color-coded prefix.
Pro Tip
Before answering, structure your response: one-line definition → real-world analogy → concrete example from a project. This makes even complex Docker answers easy to follow.