{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "item": { "id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "slug": "choose-docker-non-blocking-logging-with-an-explicit-loss-budget", "url": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/" }, "title": "Choose Docker non-blocking logging with an explicit loss budget", "summary": "Avoiding log backpressure trades a stalled writer for possible missing records.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:06+00:00", "modified_at": "2026-10-20T18:34:32+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 261, "potentially_affected": "Review Docker's container-to-driver delivery mode and the behavior of its intermediate buffer.", "dse_recommendation": "DSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records.", "primary_source": { "name": "Docker documentation — Configure logging drivers", "url": "https://docs.docker.com/engine/logging/configure/", "published_on": null, "authority": "docs.docker.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Avoiding log backpressure trades a stalled writer for possible missing records.

\n

Source facts

\n

Docker supports blocking delivery from a container to its logging driver and non-blocking delivery through an intermediate per-container buffer. Non-blocking mode prevents the application’s log writes from waiting on the driver. When that buffer is full, new messages are not enqueued and are dropped. Buffering therefore changes the failure mode rather than guaranteeing delivery.

\n

Source: Docker documentation — Configure logging drivers.

\n

Applicability

\n

Review Docker’s container-to-driver delivery mode and the behavior of its intermediate buffer.

\n

DSE recommendation

\n

DSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records. Record that decision with the service owner before changing delivery mode. Size and monitor buffering from observed log volume and outage expectations rather than an arbitrary large value. Separate essential business records from best-effort diagnostic output when those records require stronger delivery guarantees. Include the downstream driver and collector in the review so increasing one buffer does not conceal an unresolved export bottleneck.

\n

Verification

\n

In a disposable environment, simulate a slow or unavailable log destination while observing application responsiveness and message continuity. Verify that the selected mode produces the accepted behavior. Confirm operational monitoring can identify sustained logging trouble without relying only on messages that may themselves be dropped. Use numbered benign records to reconcile generation and receipt across the interruption. Have the service owner sign off the observed responsiveness and missing-record result against the chosen tradeoff, including the monitoring path used to detect trouble.

\n

Official reference

\n

Docker documentation — Configure logging drivers. Reviewed October 20, 2026.

", "content_text": "Avoiding log backpressure trades a stalled writer for possible missing records.\nSource facts\nDocker supports blocking delivery from a container to its logging driver and non-blocking delivery through an intermediate per-container buffer. Non-blocking mode prevents the application’s log writes from waiting on the driver. When that buffer is full, new messages are not enqueued and are dropped. Buffering therefore changes the failure mode rather than guaranteeing delivery.\nSource: Docker documentation — Configure logging drivers.\nApplicability\nReview Docker’s container-to-driver delivery mode and the behavior of its intermediate buffer.\nDSE recommendation\nDSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records. Record that decision with the service owner before changing delivery mode. Size and monitor buffering from observed log volume and outage expectations rather than an arbitrary large value. Separate essential business records from best-effort diagnostic output when those records require stronger delivery guarantees. Include the downstream driver and collector in the review so increasing one buffer does not conceal an unresolved export bottleneck.\nVerification\nIn a disposable environment, simulate a slow or unavailable log destination while observing application responsiveness and message continuity. Verify that the selected mode produces the accepted behavior. Confirm operational monitoring can identify sustained logging trouble without relying only on messages that may themselves be dropped. Use numbered benign records to reconcile generation and receipt across the interruption. Have the service owner sign off the observed responsiveness and missing-record result against the chosen tradeoff, including the monitoring path used to detect trouble.\nOfficial reference\nDocker documentation — Configure logging drivers. Reviewed October 20, 2026.", "content_markdown": "Avoiding log backpressure trades a stalled writer for possible missing records.\n\n## Source facts\n\nDocker supports blocking delivery from a container to its logging driver and non-blocking delivery through an intermediate per-container buffer. Non-blocking mode prevents the application’s log writes from waiting on the driver. When that buffer is full, new messages are not enqueued and are dropped. Buffering therefore changes the failure mode rather than guaranteeing delivery.\n\nSource: [Docker documentation — Configure logging drivers](https://docs.docker.com/engine/logging/configure/).\n\n## Applicability\n\nReview Docker’s container-to-driver delivery mode and the behavior of its intermediate buffer.\n\n## DSE recommendation\n\nDSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records. Record that decision with the service owner before changing delivery mode. Size and monitor buffering from observed log volume and outage expectations rather than an arbitrary large value. Separate essential business records from best-effort diagnostic output when those records require stronger delivery guarantees. Include the downstream driver and collector in the review so increasing one buffer does not conceal an unresolved export bottleneck.\n\n## Verification\n\nIn a disposable environment, simulate a slow or unavailable log destination while observing application responsiveness and message continuity. Verify that the selected mode produces the accepted behavior. Confirm operational monitoring can identify sustained logging trouble without relying only on messages that may themselves be dropped. Use numbered benign records to reconcile generation and receipt across the interruption. Have the service owner sign off the observed responsiveness and missing-record result against the chosen tradeoff, including the monitoring path used to detect trouble.\n\n## Official reference\n\n[Docker documentation — Configure logging drivers](https://docs.docker.com/engine/logging/configure/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "url": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Choose Docker non-blocking logging with an explicit loss budget", "item": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/#article", "identifier": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "url": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/", "headline": "Choose Docker non-blocking logging with an explicit loss budget", "description": "Avoiding log backpressure trades a stalled writer for possible missing records.", "abstract": "Avoiding log backpressure trades a stalled writer for possible missing records.", "articleBody": "Avoiding log backpressure trades a stalled writer for possible missing records.\nSource facts\nDocker supports blocking delivery from a container to its logging driver and non-blocking delivery through an intermediate per-container buffer. Non-blocking mode prevents the application’s log writes from waiting on the driver. When that buffer is full, new messages are not enqueued and are dropped. Buffering therefore changes the failure mode rather than guaranteeing delivery.\nSource: Docker documentation — Configure logging drivers.\nApplicability\nReview Docker’s container-to-driver delivery mode and the behavior of its intermediate buffer.\nDSE recommendation\nDSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records. Record that decision with the service owner before changing delivery mode. Size and monitor buffering from observed log volume and outage expectations rather than an arbitrary large value. Separate essential business records from best-effort diagnostic output when those records require stronger delivery guarantees. Include the downstream driver and collector in the review so increasing one buffer does not conceal an unresolved export bottleneck.\nVerification\nIn a disposable environment, simulate a slow or unavailable log destination while observing application responsiveness and message continuity. Verify that the selected mode produces the accepted behavior. Confirm operational monitoring can identify sustained logging trouble without relying only on messages that may themselves be dropped. Use numbered benign records to reconcile generation and receipt across the interruption. Have the service owner sign off the observed responsiveness and missing-record result against the chosen tradeoff, including the monitoring path used to detect trouble.\nOfficial reference\nDocker documentation — Configure logging drivers. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:06+00:00", "dateModified": "2026-10-20T18:34:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose Docker non-blocking logging with an explicit loss budget" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 261, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Docker documentation — Configure logging drivers", "url": "https://docs.docker.com/engine/logging/configure/" } } ] } }