<p>I can't find where the kubelet logs are located for Docker Desktop (Windows). There's a similar question <a href="https://stackoverflow.com/questions/34113476/where-are-the-kubernetes-kubelet-logs-located">here</a>, but the answers all refer to linux/kind installs of kubernetes.</p>

CJ Virtucio
<p><em>I get that this is an old question, but it does seem to get some traffic, has no accepted answer and is the only of this kind on SO - here is my take on this problem and a solution:</em></p>
<h2>The process</h2>
<p>As already pointed out by @acid_fuji, everything is running inside a VM we need to access, to get the required information. As most things in Linux have some representation in the filesystem, and tools like <code>ps</code> use <em>procfs</em> to query the requested information, mounting the VMs root directory (<code>/</code>) ist sufficient for introspection and quite easy:</p>
<p>Run a container and mount the VMs root directory <code>/</code> to <code>/host</code>:</p>
<pre class="lang-bash prettyprint-override"><code>docker run --rm -it -v /:/host alpine
</code></pre>
<p>In that container, get a shell with the VMs root directory in <code>/host</code> as root <code>/</code>:</p>
<pre class="lang-bash prettyprint-override"><code>chroot /host
</code></pre>
<p>From this shell with changed root directory, tools like <code>ps</code> will return information about the VM and not your container anymore. Next step is to find some information about the running <code>kubelet</code>. Get a tree formatted list of all running processes in the VM with their command line and highlight <em>kubelet</em>:</p>
<pre class="lang-bash prettyprint-override"><code>ps -ef --forest | grep --color -E 'kubelet|$'
</code></pre>
<p>Reduced to the relevant portions, the result will look something like this:</p>
<pre><code>UID        PID  PPID  C STIME TTY          TIME CMD
...
root        30     1  0 Aug11 ?        00:05:09 /usr/bin/memlogd -fd-log 3 -fd-query 4 -max-lines 5000 -max-line-len 1024
...
root       543     1  0 Aug11 ?        00:00:16 /usr/bin/containerd-shim-runc-v2 -namespace services.linuxkit -id docker -address /run/containerd/containerd.sock
root       563   543  0 Aug11 ?        00:00:02  \_ /usr/bin/docker-init /usr/bin/entrypoint.sh
root       580   563  0 Aug11 ?        00:00:00  |   \_ /bin/sh /usr/bin/entrypoint.sh
root       679   580  0 Aug11 ?        00:00:00  |       \_ /usr/bin/logwrite -n lifecycle-server /usr/bin/lifecycle-server
root       683   679  0 Aug11 ?        00:00:35  |           \_ /usr/bin/lifecycle-server
...
root      1539   683  0 Aug11 ?        00:00:01  |               \_ /usr/bin/logwrite -n kubelet kubelet --kubeconfig=/etc/kubernetes/kubelet.conf --config /etc/kubeadm/kubelet.yaml --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --hostname-override=docker-desktop --container-runtime=remote --container-runtime-endpoint unix:///var/run/cri-dockerd.sock
root      1544  1539  2 Aug11 ?        00:38:38  |                   \_ kubelet --kubeconfig=/etc/kubernetes/kubelet.conf --config /etc/kubeadm/kubelet.yaml --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --hostname-override=docker-desktop --container-runtime=remote --container-runtime-endpoint unix:///var/run/cri-dockerd.sock
</code></pre>
<p>We find <code>kubelet</code> as PID <strong>1544</strong>, spawned by <code>logwrite</code> (PID <strong>1539</strong>). Issuing <code>logwrite --help</code> we find the <code>-n</code> flag to set the name to appear in logs for the launched instance, and <code>logwrite</code> to be sending its logs to <code>memlogd</code>, which we find as PID <strong>30</strong>.</p>
<p>Knowing what to search for I found this blog post <a href="https://www.docker.com/blog/capturing-logs-in-docker-desktop/" rel="nofollow noreferrer">Capturing Logs in Docker Desktop</a> describing how logging in <em>Docker Desktop</em> is implemented. What we can learn:</p>
<p><code>logwrite</code> and <code>memlogd</code> are part of <a href="https://github.com/linuxkit/linuxkit" rel="nofollow noreferrer">Linuxkit</a>, and LinuxKit provides binaries of their packages as containers, with the logging infrastructure as <a href="https://hub.docker.com/r/linuxkit/memlogd" rel="nofollow noreferrer"><code>linuxkit/memlogd</code></a>. <code>memlogd</code> has a socket to query for logs at <code>/run/guest-services/memlogdq.sock</code>.</p>
<p><em>Be aware, that the <code>latest</code>-tag on <code>linuxkit/memlogd</code> is quite useless and pick a specific tag matching the running version in the VM; just try another version if the next step errors.</em></p>
<h2>The solution</h2>
<p>Run <code>logread</code> from <a href="https://hub.docker.com/r/linuxkit/memlogd" rel="nofollow noreferrer"><code>linuxkit/memlogd</code></a> and mount the VMs <code>/run/guest-services/memlogdq.sock</code> to the <code>logread</code>s expected default location at <code>/var/run/memlogdq.sock</code>. Tell <code>logread</code> to either show only new entries and follow, using <code>-f</code>, or dump all existing entries and follow with <code>-F</code>. Pipe this through something like grep, or a powershell equivalent and filter for <code>kubelet</code>:</p>
<pre class="lang-bash prettyprint-override"><code># example assuming presence grep on windows
docker run --rm -it -v /run/guest-services/memlogdq.sock:/var/run/memlogdq.sock linuxkit/memlogd:014f86dce2ea4bb2ec13e92ae5c1e854bcefec40 /usr/bin/logread -F | grep -i kubelet
</code></pre>
<p>Tag <code>014f86dce2ea4bb2ec13e92ae5c1e854bcefec40</code> is working with <em>Docker Desktop <code>v4.11.1</code></em>; just test which container version/tag works with your docker version.</p>
