# Choose Docker non-blocking logging with an explicit loss budget

> Avoiding log backpressure trades a stalled writer for possible missing records.

- Canonical URL: https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:06+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Avoiding log backpressure trades a stalled writer for possible missing records.

## Potentially affected

Review Docker's container-to-driver delivery mode and the behavior of its intermediate buffer.

## DSE recommendation

DSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records.

## Article

Avoiding log backpressure trades a stalled writer for possible missing records.

## Source facts

Docker supports blocking delivery from a container to its logging driver and non-blocking delivery through an intermediate per-container buffer. Non-blocking mode prevents the application’s log writes from waiting on the driver. When that buffer is full, new messages are not enqueued and are dropped. Buffering therefore changes the failure mode rather than guaranteeing delivery.

Source: [Docker documentation — Configure logging drivers](https://docs.docker.com/engine/logging/configure/).

## Applicability

Review Docker’s container-to-driver delivery mode and the behavior of its intermediate buffer.

## DSE recommendation

DSE recommends deciding which is more damaging for the workload: delayed application writes or loss of diagnostic records. Record that decision with the service owner before changing delivery mode. Size and monitor buffering from observed log volume and outage expectations rather than an arbitrary large value. Separate essential business records from best-effort diagnostic output when those records require stronger delivery guarantees. Include the downstream driver and collector in the review so increasing one buffer does not conceal an unresolved export bottleneck.

## Verification

In a disposable environment, simulate a slow or unavailable log destination while observing application responsiveness and message continuity. Verify that the selected mode produces the accepted behavior. Confirm operational monitoring can identify sustained logging trouble without relying only on messages that may themselves be dropped. Use numbered benign records to reconcile generation and receipt across the interruption. Have the service owner sign off the observed responsiveness and missing-record result against the chosen tradeoff, including the monitoring path used to detect trouble.

## Official reference

[Docker documentation — Configure logging drivers](https://docs.docker.com/engine/logging/configure/). Reviewed October 20, 2026.

## Primary reference

- Name: Docker documentation — Configure logging drivers
- Authority: docs.docker.com
- URL: https://docs.docker.com/engine/logging/configure/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose Docker non-blocking logging with an explicit loss budget,” DSE Security, https://update.dsesecurity.com/updates/choose-docker-non-blocking-logging-with-an-explicit-loss-budget/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.