Log rotation on the json-file driver, which has no default limit

The default logging driver writes to a JSON file that grows without bound, so a chatty container will fill the host disk over a fortnight and nothing warns first.

# per service
logging:
  driver: json-file
  options:
    max-size: '10m'
    max-file: '3'

# or once, in /etc/docker/daemon.json, for everything:
# { "log-driver": "json-file",
#   "log-opts": { "max-size": "10m", "max-file": "3" } }

Setting it in the daemon configuration is the version that actually protects you, because a per-service setting is one somebody will forget on the eighth service. Note that changing the daemon default does not affect containers that already exist — they keep the settings they were created with, so the change needs a recreate rather than a restart. Checking /var/lib/docker/containers/*/;*-json.log sizes on an existing host is usually educational.