# Recreate Docker containers when applying new JSON log rotation defaults

> Editing daemon defaults does not retrofit existing containers’ logging configuration.

- Canonical URL: https://update.dsesecurity.com/updates/recreate-docker-containers-when-applying-new-json-log-rotation-defaults/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:07+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Editing daemon defaults does not retrofit existing containers’ logging configuration.

## Potentially affected

Review json-file rotation settings on newly created containers and compare existing containers separately.

## DSE recommendation

DSE recommends inventorying current containers and their effective logging options before declaring rotation complete.

## Article

Editing daemon defaults does not retrofit existing containers’ logging configuration.

## Source facts

Docker’s json-file logging driver supports max-size and max-file options for rotation. The documentation states that daemon-level changes take effect for newly created containers after the daemon configuration is applied. Existing containers do not automatically use the new logging configuration. Their effective settings must therefore be checked separately from the host default.

Source: [Docker documentation — JSON File logging driver](https://docs.docker.com/engine/logging/drivers/json-file/).

## Applicability

Review json-file rotation settings on newly created containers and compare existing containers separately.

## DSE recommendation

DSE recommends inventorying current containers and their effective logging options before declaring rotation complete. Plan replacement through the workload’s managed deployment procedure so state and availability are preserved. Keep the desired limits in that definition as well as any host default. Compare log production with available disk space and retention needs, and send required historical records to a suitable archive. Track containers intentionally deferred from recreation so a changed default does not create a false sense that all disks are protected.

## Verification

Create a disposable container after the configuration change and inspect its driver and rotation options. Compare an older container to demonstrate the difference. Generate only safe test output and verify rotation without modifying daemon-managed files. Confirm the production replacement plan covers every relevant workload. Retain a per-container replacement checklist with the inspected options. Ask the logging owner to approve any intentionally different retention behavior, and keep required archive delivery separate from the local rotation exercise.

## Official reference

[Docker documentation — JSON File logging driver](https://docs.docker.com/engine/logging/drivers/json-file/). Reviewed October 20, 2026.

## Primary reference

- Name: Docker documentation — JSON File logging driver
- Authority: docs.docker.com
- URL: https://docs.docker.com/engine/logging/drivers/json-file/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Recreate Docker containers when applying new JSON log rotation defaults,” DSE Security, https://update.dsesecurity.com/updates/recreate-docker-containers-when-applying-new-json-log-rotation-defaults/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.