The default logging driver writes to a file that grows without bound, so a chatty container fills the host disk over a fortnight and nothing warns first.
// /etc/docker/daemon.json — for everything, including existing hosts
{
"log-driver": "json-file",
"log-opts": { "max-size": "10m", "max-file": "3" },
"features": { "buildkit": true }
}Setting it in the daemon configuration is what actually protects you, because a per-service setting is one somebody will forget on the eighth service. The detail that catches people is that changing the daemon default does not affect containers that already exist — they keep the settings they were created with, so the change needs a recreate rather than a restart. Checking the sizes under /var/lib/docker/containers on an existing host is usually educational.