<p>I'm trying to figure out where a program run in a container stores its logs.  But, I don't have SSH access to the machine which deployed container, only <code>kubectl</code>.  Suppose I had SSH access, I'd do something like this:</p>

<pre><code>ssh machine-running-docker 'docker diff \
    $(kubectl describe pod pod-name | \
      grep 'Conainer ID' | sed -E s#^[^/]+//(.+)$#\1#)'
</code></pre>

<p>(The regex may be imprecise, just to give the idea).</p>

<p>Well, for starters, an app in container should not store it's logs in files inside container. That said, it is sometimes hard to avoid when you work with 3rd party apps not configured for logging to stdout / some logging service.</p>

<p>Good old <code>find</code> to the rescue - just <code>kubectl exec</code> into the pod/container and <code>find / -mmin -1</code> will give you all files modified in last 1 min. That should narrow the list enough for you (assuming the container lived for few minutes already).</p>
