Docker Log Collection

Docker Log Collection

How application logs get from container to storage.

Pipeline

App writes to stdout/stderr
  --> Docker captures PID 1 output
  --> Writes JSON to /var/lib/docker/containers/<id>/<id>-json.log
  --> Agent (Promtail/Vector) reads via Docker API
  --> Sends to storage (Loki/ClickHouse)

Apache in Docker (piped logging)

Apache workers write to their own stdout, not PID 1. Use piped logging:

ErrorLog "||/bin/cat >&2"
CustomLog "||/bin/cat" combined

|| = respawnable pipe (Apache restarts the process if it dies).

Entrypoint must make Apache PID 1:

#!/bin/sh
. /etc/apache2/envvars
exec apache2 -D FOREGROUND

Key Points

• Docker only captures stdout/stderr of PID 1
• Use exec in entrypoint to make app PID 1
• /dev/stdout in worker = worker's own fd, not PID 1's
• Symlink /proc/1/fd/1 works but piped logging is cleaner for Apache