This error occurs when Docker cannot find the specified logging driver. The driver may not be installed, may require a plugin installation, or may not be available on your Docker version.
When you configure a container or the Docker daemon to use a specific logging driver, Docker needs to recognize and load that driver before it can route container logs. If Docker encounters a driver name it doesn't recognize, it fails with "unknown logging driver." Docker supports several built-in logging drivers out of the box: `json-file` (the default), `local`, `syslog`, `journald`, `gelf`, `fluentd`, `awslogs`, `splunk`, and `gcplogs`. However, some drivers like `loki` require installing a plugin first, and others may not be available on all platforms. This error commonly appears when: - Using a third-party logging driver without installing its plugin - Referencing a misspelled driver name in daemon.json or docker-compose.yml - After a Docker upgrade where the daemon state becomes inconsistent - Running containers with `--live-restore` enabled and the daemon was restarted
First, verify which logging drivers are available on your system:
docker info | grep -i loggingThis shows the default driver and lists supported drivers. You should see something like:
Logging Driver: json-file
Supported Logging Drivers: awslogs, fluentd, gcplogs, gelf, journald, json-file, local, splunk, syslogIf the driver you need isn't listed, it either requires a plugin or isn't supported on your system.
Check your configuration for typos. The driver name must exactly match one of the supported drivers.
In daemon.json (/etc/docker/daemon.json):
{
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
}
}In docker-compose.yml:
services:
app:
image: myapp
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"Common built-in drivers: json-file, local, syslog, journald, gelf, fluentd, awslogs, splunk, gcplogs, none
Some logging drivers require installing a Docker plugin first.
For Loki logging driver:
docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissionsFor Splunk Connect:
docker plugin install splunk/docker-logging-plugin:latest --alias splunk-logging-pluginFor Docker Desktop:
Go to Settings > Plugins and enable the logging plugin you need.
After installing, verify the plugin is active:
docker plugin lsIf you recently upgraded Docker or changed the daemon configuration, restart the Docker service:
On Linux (systemd):
sudo systemctl restart dockerOn macOS/Windows:
Restart Docker Desktop from the system tray/menu bar.
Important: If you're using --live-restore, containers will keep running during restart, but they may have issues with the new logging driver configuration. You may need to restart the affected containers:
docker-compose down && docker-compose up -dInvalid JSON in daemon.json can cause logging driver issues. Validate your configuration:
cat /etc/docker/daemon.json | python3 -m json.toolCommon mistakes:
- Missing quotes around option values (all values must be strings)
- Trailing commas after the last item
- Missing commas between items
Correct format:
{
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
}
}Note: All log-opts values must be strings, even numbers like "3".
If you need containers running immediately while troubleshooting, switch to the default json-file driver:
Remove custom driver from daemon.json or set:
{
"log-driver": "json-file"
}Override at container level:
docker run --log-driver=json-file myimageIn docker-compose.yml:
services:
app:
image: myapp
logging:
driver: "json-file"This allows you to run containers while you resolve the logging driver issue.
### Platform-Specific Driver Support
Not all logging drivers work on all platforms:
| Driver | Linux | Windows | macOS (Docker Desktop) |
|--------|-------|---------|------------------------|
| json-file | Yes | Yes | Yes |
| local | Yes | Yes | Yes |
| syslog | Yes | No | Yes |
| journald | Yes (systemd) | No | No |
| gelf | Yes | Yes | Yes |
| fluentd | Yes | Yes | Yes |
| awslogs | Yes | Yes | Yes |
| splunk | Yes | Yes | Yes |
| gcplogs | Yes | Yes | Yes |
### Live Restore Considerations
When running Docker with --live-restore enabled, upgrading Docker can cause "unknown logging driver" errors because:
1. The old daemon used in-process logging driver management
2. After restart, the new daemon doesn't know about the old driver state
3. Existing containers reference a driver the new daemon can't recognize
Solution: After a Docker upgrade with live-restore, restart affected containers:
docker restart $(docker ps -q)### Journald on Alpine Linux
If using journald on Alpine, you need additional packages:
RUN apk add --no-cache libc6-compat libintlWithout these, journald logging silently fails or reports "unknown driver."
### Boot Race Conditions
If using a plugin-based driver (like Loki) and seeing errors only at system boot, it's likely a race condition where Docker starts before the plugin initializes.
Fix for systemd:
Create /etc/systemd/system/docker-logging-plugin.service:
[Unit]
Description=Ensure Docker logging plugin is ready
After=docker.service
Requires=docker.service
[Service]
Type=oneshot
ExecStart=/usr/bin/docker plugin enable loki
RemainAfterExit=yes
[Install]
WantedBy=multi-user.targetOr add a delay in your container start scripts to allow the plugin to initialize.
### Debugging Plugin Issues
To debug plugin problems:
# Check plugin status
docker plugin inspect loki
# View plugin logs (if available)
journalctl -u docker | grep -i plugin
# Reinstall plugin
docker plugin disable loki
docker plugin rm loki
docker plugin install grafana/loki-docker-driver:latest --alias loki --grant-all-permissionsimage operating system "linux" cannot be used on this platform
How to fix 'image operating system linux cannot be used on this platform' in Docker
manifest unknown: manifest unknown
How to fix 'manifest unknown' in Docker
cannot open '/etc/passwd': Permission denied
How to fix 'cannot open: Permission denied' in Docker
Error response from daemon: failed to create the ipvlan port
How to fix 'failed to create the ipvlan port' in Docker
toomanyrequests: Rate exceeded for anonymous users
How to fix 'Rate exceeded for anonymous users' in Docker Hub