Windows 10 and Docker container logs / Docker Logging driver

For Windows 10 + WSL 2 (Ubuntu 20.04), Docker version 20.10.2, build 2291f61

Lets DOCKER_ARTIFACTS == \\wsl$\docker-desktop-data\version-pack-data\community\docker

Container logs can be found in the following location

DOCKER_ARTIFACTS\containers\[Your_container_ID]\[Your_container_ID]-json.log

Here is an example :

Check first if those logs are in (as suggested here):

C:\ProgramData\docker\containers\[container_ID]\[container_ID]-json.log

The Docker C:\ProgramData\docker is the Root Dir reported by docker info.

Regarding Docker Linux through Hyper-v, check if "How to Delete Docker Container Log Files (Windows or Linux) " can help (from Jon Gallant):

1. Run docker inspect to find your Docker log file location
2. Find the “Docker Root Dir” Value, mine is /var/lib/docker

Your docker log file path should be /var/lib/docker, but if it isn’t, then change it in the command below.

find /var/lib/docker/containers/ -type f -name "*.log"

The command you see in this image is based on "How to SSH into the Docker VM (MobyLinuxVM) on Windows"

We aren’t technically going to SSH into the VM, we’ll create a container that has full root access and then access the file system from there.

• Get container with access to Docker Daemon
• Run container with full root access
• Switch to host file system

Open a Command prompt and execute the following:

docker run --privileged -it -v /var/run/docker.sock:/var/run/docker.sock jongallant/ubuntu-docker-client 
docker run --net=host --ipc=host --uts=host --pid=host -it --security-opt=seccomp=unconfined --privileged --rm -v /:/host alpine /bin/sh
chroot /host

Execute the find command there, and you should find the logs.

For Windows 10 + Docker Desktop version 3.6.0, the virtual path for logs and data (artifacts) is \\wsl$\docker-desktop-data\version-pack-data\community\docker (you can copy/paste it in Explorer navigation bar).

The logs are at \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\[containerID]\[containerID]-json.logs

and the data is under \\wsl$\docker-desktop-data\version-pack-data\community\docker\volumes\[volumeID]\_data

How to get containerID:

You can find container ID (truncated) by running docker ps in a command prompt. You can also find it by clicking the CLI button on DockerDesktop next to the container name, the id will be in the title of the cmd window that will pop up. Once you have the id, you can navigate to containers\[containerID] under the artifacts directory (\\wsl$\docker-... above). The log file will have the .log extension and its name will have the containerID in it. Keep in mind that it will be an enriched json format though, so not easily readable.

How to get volumeID:

To find a container's data (for example kafka broker topics), you need to find the id of the volumes where the data is stored. For that you will need to click on the container in DockerDesktop, then click INSPECT (top right). You can then scroll down to find Mounts configuration entries. Each mount will have a volumeID (different from containerID), and that volumeID will be part of a path similar to this one /var/lib/docker/volumes/71f7a5992c58fdcf229c3848acb014712f34fab380bc7c712cf5a0a632fe9110/_data. volumeID here being 71f7a5992c58fdcf229c3848acb014712f34fab380bc7c712cf5a0a632fe9110. You can then take volumeID and navigate to volumes\[volumeID] under the artifacts directory (\\wsl$\docker-... above) where the data will be located.

For Windows Users who wants to delete all Docker log files on WSL 2.

The path to the docker container is correct thx to @craftsmannadeem

\\wsl$\docker-desktop-data\version-pack-data\community\docker\containers

Here a command to execute on Windows to delete all log files:

del /s \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\*-json.log

Bye bye Docker logs:

File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\2012efd0ccfb8aed6291dd9a3b7b5aef507b6af4fce5b85e9306f45980db9531\2012efd0ccfb8aed6291dd9a3b7b5aef507b6af4fce5b85e9306f45980db9531-json.log
File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\9e627f1fe8f3c3ab85c64f85f93942d1f077e9a6e2896b51df782b0c0c3777d1\9e627f1fe8f3c3ab85c64f85f93942d1f077e9a6e2896b51df782b0c0c3777d1-json.log
File was deleted - \\wsl$\docker-desktop-data\version-pack-data\community\docker\containers\6ea8f3cb354c199bc719701f8f1e75c333f81cd2f03dca0c7a626cbcbf9ed5a0\6ea8f3cb354c199bc719701f8f1e75c333f81cd2f03dca0c7a626cbcbf9ed5a0-json.log
...

For window system logs are located at C:\ProgramData\Docker\containers or %APPDATA%\Docker For Linux system logs are located at /var/lib/docker/containers

For me, using Docker Desktop for Windows on version 4.9.1 (81317), Windows 10 21H2, WSL 2 mode, the containers' folders were at

\\wsl$\docker-desktop-data\data\docker\containers

Slightly different from the others.

I couldn't find where the logs were stored locally. (Good chance they aren't plain text any more. However, if you just need the output of the logs, you can run a command like this:

docker logs --details [container-name] > container-name.log

This will grab the logs for the container and write them to a log file in the current directory.

Note: The --details adds additional info to the logs like environment variables and the like, but is not required for the command to work.