Docker and Compose
Stop Docker container logs filling the disk
Set log rotation, centralize useful events and alert on filesystem usage before containers fail.
By AppLaunch Editorial · Reviewed 2026-08-25
Direct answer
Unlimited local JSON logs can consume the filesystem and take every service down. Set size and file-count limits or use a managed logging driver, keep high-value structured events, and alert on both growth rate and remaining space.
What this means in plain English
Containers can produce logs much faster than expected, especially when an error repeats. If local log files have no size limit, they can fill the host disk and break every service, including the one you need to investigate the problem.
Set a maximum file size and number of old files, or send logs to a managed system with a retention policy. Keep useful events and request details, but remove secrets and turn noisy debug logging off after the investigation.
How much log history belongs on the host?
| Retention | Defined by incident and compliance need |
|---|---|
| Rotation | Bounded size and number of local files |
| Detection | Filesystem and per-service log growth alerts |
A simple example
A failed API call is retried several times each second and writes a large stack trace every time. Within a day the Docker log consumes most of the disk. Rotation limits the damage, while a rate-limited error and alert lead the team to the real broken API.
What to do, step by step
1. Identify the largest container logs.
Start here before buying anything or changing several settings at once. It gives you a clear starting point based on retention: defined by incident and compliance need. Write the result down so you can compare it later.
2. Fix noisy repeated errors at source.
Use the same files, versions and settings that the real project will use. A quick test with an empty or different setup can look successful while completely missing the problem you are trying to solve.
3. Configure bounded rotation.
Try the busiest realistic situation, not the easiest one. Include the people, data, traffic or background work you genuinely expect, then watch for slowdowns and errors rather than relying on a single headline number.
4. Test that old logs expire and new logs remain searchable.
Finish by checking the result against detection: filesystem and per-service log growth alerts. Keep the old setting or release available until you know the change works and can be reversed safely.
One more useful tip
Alert on how quickly free space is shrinking as well as the percentage already used. Fast growth can become an emergency long before a simple 90% alert runs.
Common mistakes and how to avoid them
Deleting an open log without understanding disk handles.
This gives a misleading or unsafe result because it leaves out retention. A better approach is to identify the largest container logs, then check the result before making the change permanent.
Keeping debug logging permanently.
This gives a misleading or unsafe result because it leaves out rotation. A better approach is to fix noisy repeated errors at source, then check the result before making the change permanent.
Collecting secrets in logs.
This gives a misleading or unsafe result because it leaves out detection. A better approach is to configure bounded rotation, then check the result before making the change permanent.
Words explained
- container
- A packaged, isolated way to run an application with the files and software it needs.
- secret
- A password, token or key that must not be committed to source control or exposed to users.
Quick checklist
- Identify the largest container logs.
- Fix noisy repeated errors at source.
- Configure bounded rotation.
- Test that old logs expire and new logs remain searchable.
Common questions
What is the simple answer?
Unlimited local JSON logs can consume the filesystem and take every service down. Set size and file-count limits or use a managed logging driver, keep high-value structured events, and alert on both growth rate and remaining space.
What should I check first?
Start with retention: defined by incident and compliance need. That is usually more useful than choosing from a marketing label or copying somebody else’s setting.
How can I make the change safely?
Identify the largest container logs. Then change one thing at a time, keep a backup or old version, and use the same real-world test after each change.
What is the easiest mistake to avoid?
Deleting an open log without understanding disk handles. Avoiding that one mistake makes the rest of the comparison much more trustworthy.