<p>There is an official manifest for the deployment of the daemonset <a href="https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/elasticsearch/fluent-bit-ds.yaml" rel="nofollow noreferrer">https://raw.githubusercontent.com/fluent/fluent-bit-kubernetes-logging/master/output/elasticsearch/fluent-bit-ds.yaml</a></p>
<p>Line 49 defines the volume <code>varlibdockercontainers</code>.</p>
<p>I don't understand why the Fluent-bit needs to read data from the folder <code>/var/lib/docker/containers</code>.</p>

<blockquote>
<p>I don't understand why the Fluent-bit needs to read data from the folder <code>/var/lib/docker/containers</code>.</p>
</blockquote>
<p>Because that is where docker stores its <code>${container_id}-json.log</code> file when using the <a href="https://docs.docker.com/config/containers/logging/json-file/" rel="nofollow noreferrer"><code>json-file</code> logging driver</a>, which is (AFAIK) the default. There are more details <a href="https://stackoverflow.com/questions/44579227/where-is-the-docker-json-file-logging-driver-writing-files-to">in this related question</a></p>
<p>Therefore, in order for fluent to transmit logs, it does (effectively) <code>tail -f $the_log_filename | jq -r .log</code> and those are the container's logs. If you want to see the <em>actual</em> implementation, it seems to be in <a href="https://github.com/fluent/fluent-bit/blob/v1.8.10/plugins/in_docker/docker.h#L40" rel="nofollow noreferrer"><code>docker.h</code></a> and its <code>docker.c</code> peer</p>
