How does Docker handle logging?

Docker captures output from container's stdout and stderr and routes it through a logging driver. The default driver is json-file — logs are stored as JSON files on the host at /var/lib/docker/containers/<container-id>/<container-id>-json.log. Available drivers: json-file (default), syslog, journald, gelf (Graylog), fluentd, awslogs (CloudWatch), splunk, none. Configure globally in /etc/docker/daemon.json: {"log-driver": "json-file", "log-opts": {"max-size": "100m", "max-file": "3"}}. Per container: docker run --log-driver fluentd myapp. Log rotation is critical — without limits, json-file logs can fill the disk. Configure: --log-opt max-size=100m --log-opt max-file=3 (keeps last 3 files of 100MB each). Application best practice: write logs to stdout/stderr (not to files inside the container) — Docker captures and routes them. Commands: docker logs mycontainer; docker logs -f --tail 100 mycontainer. For production: use a log aggregation system — ship logs to Elasticsearch (via Fluentd/Logstash), CloudWatch, Datadog, or Splunk. docker compose logs -f combines logs from all services with color-coded prefix.