Container logging and monitoring encompasses the practices, tools, and patterns for collecting, aggregating, and analyzing logs, metrics, and traces from containerized applications running in Docker, Kubernetes, and orchestrated environments. Unlike traditional monolithic applications where logs and metrics reside on persistent hosts, containers are ephemeral and stateless — they start, stop, and restart frequently, making centralized collection essential. Modern container observability relies on stdout/stderr streams as the standard output mechanism, log drivers to route data, health probes to ensure availability, and metrics exporters to track resource consumption. Understanding this ecosystem is critical because improper logging configuration can lead to disk exhaustion, lost diagnostics during crashes, and inability to trace requests across distributed microservices.
What This Cheat Sheet Covers
This topic spans 17 focused tables and 159 indexed concepts, 128 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Container Log Output Streams
The standard contract for container logging is simple: write everything to stdout and stderr, and let the platform handle collection. Understanding how the container runtime captures, stores, and exposes these streams — including the CRI log format used by modern runtimes like containerd — is the foundation for every other logging decision.
| Concept | Example | Description | |
|---|---|---|---|
echo "Request processed" > /dev/stdout | • Standard output stream where applications write normal log messages • captured automatically by the container runtime. | ||
echo "Error occurred" >&2 | • Standard error stream for error and warning messages • also captured by runtime and often displayed separately in log tools. | ||
console.log("msg") writes to stdout | • Treats logs as event streams written to stdout/stderr • no file management inside containers — the platform collects them. | ||
{"level":"info","msg":"user_login","user_id":12} | Writing key-value JSON to stdout enables parsing and indexing by log aggregators without custom regex. | ||
2025-01-15T10:00:00Z stdout F log message here | • Format used by containerd and other CRI-compatible runtimes: <timestamp> <stream> <flag> <message>• F = full line, P = partial line (multiline logs); kubelet merges partial lines. | ||
kubectl get --raw "/api/v1/namespaces/default/pods/mypod/log?stream=Stderr" | • Alpha feature allowing separate stdout/stderr stream access via Pod API • requires PodLogsQuerySplitStreams feature gate on kubelet. | ||
/var/log/app.log written by app | • Writing logs to files inside ephemeral containers requires volume mounts or sidecar exporters to extract them • not recommended for cloud-native apps. |