<p>When I run </p>

<p><code>$ kubectl logs &lt;container&gt;</code></p>

<p>I get the logs of my pods.</p>

<p>But where are the <em>files</em> for those logs?</p>

<p>Some sources says <code>/var/log/containers/</code> others says <code>/var/lib/docker/containers/</code>  but I couldn't find my actual application's or pod's log.</p>

<p><strong>Short Answer:</strong></p>

<p>If you're using Docker, the <code>stdout</code> from each container are stored in <code>/var/lib/docker/containers</code>. But Kubernetes also creates a directory structure to help you find logs based on Pods, so you can find the container logs for each Pod running on a node at <code>/var/log/pods/&lt;namespace&gt;_&lt;pod_name&gt;_&lt;pod_id&gt;/&lt;container_name&gt;/</code>.</p>

<hr>

<p><strong>Longer Answer:</strong></p>

<p>Docker traps the <code>stdout</code> logs from each container and stores them in <code>/var/lib/docker/containers</code> on the host. If Kubernetes uses Docker as the container runtime, Docker will also store the containers logs in that location on the Kubernetes node. But since we don't run containers directly in Kubernetes (we run Pods), Kubernetes also creates the <code>/var/log/pods/</code> and <code>/var/log/containers</code> directories to help us better organize the log files based on Pods.</p>

<p>Each directory within <code>/var/log/pods/</code> stores the logs for a single Pod, and each are named using the structure <code>&lt;namespace&gt;_&lt;pod_name&gt;_&lt;pod_id&gt;</code>.</p>

<blockquote>
  <p>You can get the ID of a Pod by running <code>kubectl get pod -n core gloo-76dffbd956-rmvdz -o jsonpath='{.metadata.uid}'</code>. If you're used to using <a href="https://github.com/mikefarah/yq" rel="noreferrer"><code>yq</code></a>, you may find running <code>kubectl get pod &lt;pod_name&gt; -o yaml | yq r - metadata.uid</code> more straight-forward.</p>
</blockquote>

<p>Within each <code>/var/log/pods/&lt;namespace&gt;_&lt;pod_name&gt;_&lt;pod_id&gt;/</code> directory are more directories, each representing a container within the Pod. The name of these directories is equal to the name of the container. Lastly, when we look inside a <code>/var/log/pods/&lt;namespace&gt;_&lt;pod_name&gt;_&lt;pod_id&gt;/&lt;container_name&gt;/</code> directory, we'll find symbolic links to the log files stored by Docker inside <code>/var/lib/docker/containers</code>.</p>

<p>Similarly, inside the <code>/var/log/containers/</code> directory are symlinks to a <code>/var/log/pods/&lt;namespace&gt;_&lt;pod_name&gt;_&lt;pod_id&gt;/&lt;container_name&gt;/</code> directory. These symlinks are named using the structure <code>&lt;pod_name&gt;_&lt;namespace&gt;_&lt;container_id&gt;</code>.</p>
