Logging

Purpose

Container logs (the bytes a container writes to stdout/stderr) are captured and routed by daemon/logger/. Daemon-level logs (those emitted by dockerd itself) use github.com/containerd/log directly and are not part of this subsystem.

Architecture

graph LR
  Container -->|stdout/stderr| Copier[copier.go]
  Copier -->|Message| Driver[Logger driver]
  Driver --> Sink[json-file<br/>journald<br/>fluentd<br/>etc.]

Each container has a log driver selected via --log-driver (or the daemon-wide default). The daemon attaches stdout/stderr pipes to the container, and a Copier (copier.go) splits the byte stream into Message records that get pushed into the driver.

Built-in drivers

Driver	Code	Sink
json-file	jsonfilelog/	Rotating JSON files (default).
local	local/	Compact length-prefixed format on disk.
journald	journald/	systemd journal.
syslog	syslog/	Local or remote syslog.
fluentd	fluentd/	Fluentd forwarder.
gelf	gelf/	Graylog Extended Log Format.
splunk	splunk/	Splunk HEC.
awslogs	awslogs/	AWS CloudWatch Logs.
gcplogs	gcplogs/	Google Cloud Logging.
etwlogs	etwlogs/	Windows Event Tracing for Windows (ETW).
Plugin	plugin.go	Any v1/v2 plugin implementing the log API.

The driver registry is the factory.go file (factory.go). Drivers register via RegisterLogDriver in their init().

Reading logs back

docker logs reads from the same drivers when they implement the LogReader interface. json-file, local, and journald are the readable built-ins. loggerutils/ provides shared rotation/tailing helpers (loggerutils/).

Ring buffer

To absorb bursts when the underlying driver is slow, drivers can be wrapped in the in-memory ring buffer in ring.go. It's automatically used for non-blocking drivers configured with --log-opt mode=non-blocking.

Per-OS gates

The available drivers vary by OS. logdrivers_linux.go and logdrivers_windows.go gate which drivers register at daemon startup.

Plugin drivers

A v1 or v2 logging plugin shows up to the daemon via plugin.go. The contract is documented at docs.docker.com/engine/extend/plugins_logging — the plugin exposes a JSON-over-Unix-socket API; the daemon forwards Log/Logs calls and streams.

Testing helpers

loggertest/ exposes shared driver test suites; new drivers should plug into them rather than reinventing the test scaffolding.

Entry points for modification

• New driver: register in factory.go, place implementation under daemon/logger/<name>/, add gating to the appropriate logdrivers_*.go.
• Rotation/tail logic: shared helpers in loggerutils/.
• Per-message metadata (image name, container labels): see loginfo.go.

See also

• Plugins for the plugin-driver mechanics.