Docker source

The docker source collects logs from containers on a Docker host using the Docker Engine API. It discovers running containers, supports include/exclude filters by container name, and resumes from a saved timestamp after restart.

This source requires access to the Docker socket (/var/run/docker.sock). When running reveald in a container, bind-mount the socket into the reveald container.

Configuration

{
  "sources": {
    "containers": {
      "type": "docker",
      "host": "unix:///var/run/docker.sock",
      "include": ["my-app-*", "nginx"],
      "exclude": ["reveald"],
      "labels": {
        "com.docker.compose.project": "my-stack"
      },
      "all": false,
      "startFrom": "end"
    }
  }
}

Options

Option	Type	Default	Description
`host`	string	`unix:///var/run/docker.sock`	Docker Engine API endpoint
`include`	string[]	all containers	Glob patterns matched against container name
`exclude`	string[]	none	Glob patterns to exclude
`labels`	object	none	Require containers to have these labels (AND)
`all`	bool	`false`	Include stopped containers when listing
`startFrom`	string	`"end"`	`"end"` for new logs only, `"beginning"` for full history on first sight

Event fields

Field	Value
`sourceType`	`"docker"`
`rawLog`	Log message (JSON extracted when present)
`eventTime`	Parsed from Docker log timestamp
`service.name`	Container name
`tags.container_id`	Short container ID
`tags.stream`	`stdout` or `stderr`
`tags.image`	Container image
`tags.*`	Container labels

High-watermark

The docker source saves the last seen log timestamp per container to docker-hwm.json under the reveald config directory. On restart, it resumes using the Docker API since parameter.

Log delivery is at-least-once. A crash may replay logs from the same second.

Deployment

When reveald runs in Docker and collects logs from other containers on the same host:

services:
  reveald:
    image: runreveal/reveald:latest
    restart: unless-stopped
    volumes:
      - ./config.json:/config.json:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command: run --config /config.json

Docker socket access is equivalent to root on the host. Mount read-only and restrict access to trusted environments.

Limitations

Works with logging drivers exposed through the Docker logs API (json-file, local, journald). Remote-only drivers (syslog, gelf, fluentd, awslogs) are not supported.
Not a replacement for the cri source on Kubernetes nodes — use cri for pod logs at /var/log/pods/.
Configure log rotation on the Docker daemon (max-size, max-file) to avoid unbounded disk use.