Show the production pattern: "Apps log JSON to stdout. Docker captures it. In dev, I use the json-file driver with rotation. In production, I ship to CloudWatch or Loki via a logging driver so logs are centralised and searchable."
Applications in containers should log to stdout/stderr — Docker captures these streams. Logging drivers determine where the output goes: json-file (default, local files), syslog, journald, fluentd, awslogs, gcplogs. For production: ship logs to a centralised system (ELK, Loki, CloudWatch) using a logging driver or a sidecar collector. Monitoring: docker stats for basic metrics, cAdvisor for detailed container metrics, Prometheus + Grafana for dashboards and alerting. Strong candidates discuss: the log-opts for controlling rotation and size with the json-file driver, structured logging (JSON) for parseability, the trade-off between blocking and non-blocking logging modes, and correlating logs across multiple containers with request IDs or trace context.
Tests operational maturity. Candidates who log to files inside containers lose logs when containers restart. Those who understand logging drivers, structured logging, and centralised collection build observable systems.