Write Docker container logs to a chosen file

For a temporary export, redirect docker logs. For ongoing file storage, use a logging backend that controls the destination or configure the application to write into a mounted directory. Docker's json-file driver does not expose a per-container custom filename option.

Export a retained log snapshot

docker logs --timestamps my-container > /path/to/app.log 2>&1

> replaces the destination file. To follow new output while appending:

docker logs --follow --tail 0 --timestamps my-container >> /path/to/app.log 2>&1

--tail 0 avoids replaying all retained records when starting this follow session. Redirecting both streams captures stdout and stderr, but the file no longer preserves them as separate streams. Reconnects, process failure, output-file rotation, and missing records need additional handling; a shell redirection is not a durable log-shipping service.

Route through a system logging service

For an environment with an appropriately configured local syslog service:

docker run --log-driver=syslog --log-opt tag=myapp my-image:approved

Then configure the receiver to route that tag to a file. An illustrative rsyslog rule is:

if $programname == 'myapp' then {
    action(type="omfile" file="/var/log/myapp.log")
    stop
}

Validate the actual program/tag field received, rsyslog input configuration, directory permissions, and rotation policy. Docker's logging connection originates from the daemon host; Docker Desktop and remote daemons may not share the CLI machine's syslog service. Journald is another backend with its own storage and export tools, not a direct arbitrary-filename switch.

Let the application write a mounted file

docker run --mount type=bind,src=/host/logs,dst=/var/log/myapp my-image:approved

Create the host directory first and configure the application to write there. Grant the runtime user only the required access, and arrange application-aware rotation. A file inside a volume is not automatically visible through docker logs; that command reads the logging driver's captured streams.

Bound daemon-managed storage

For new json-file containers, merge suitable daemon defaults such as:

{
  "log-driver": "json-file",
  "log-opts": {"max-size": "10m", "max-file": "3"}
}

Apply the configuration through the host's procedure and recreate existing containers to adopt new defaults. Do not move, truncate, or symlink Docker's internal log files to implement a custom destination.

DataKit logging guidance can help collect a chosen file or container stream. Confirm driver compatibility, permissions, container identifiers, and retention with an identifiable event before relying on it after container deletion.

FAQ

Does switching to syslog or journald always disable docker logs?

No. Journald supports local log reading, and supported remote drivers can use Docker's dual-logging cache unless it is disabled. Check the driver's capabilities and cache settings. Local cache retention is separate from remote retention.

Can changing daemon.json update a running container's driver?

No. The container retains its creation-time logging settings; recreate it with the desired driver and options.

Can I change Docker's entire data directory instead?

Docker has a daemon-wide data-root setting, but moving all engine storage is a separate operation. It is not a per-application log-file destination feature.

References: Docker logging drivers, dual logging, syslog driver.